fix(quota): close quota bypass + address P1 reliability findings

[jeffzakrzewski]

Summary

Addresses findings from the post-ship code review on main (commit fdd6b7f). Main is live in production; this PR doesn't block anything there but closes real gaps in the bill-defense system.

• P0 quota bypass — buildTree, DELETE /api/sessions/:id, and the post-regen wpilog GET were calling env.BLOBS.{list,get,delete} directly, letting a cookie holder burn R2 Class A/B ops for free
• P1 waitUntil silencing — a throw after the alerted_* latch flipped lost both operator email and audit row for the whole UTC day
• P1 Resend hangs — no AbortSignal meant a hung Resend connection burned the full waitUntil budget
• P1 DO double-charge — D1-batch failures forced the uploader to retry, which re-charged the quota counter for the same logical batch
• P2 concurrent first-breach race — two concurrent racers could both see alerted_*=false and both fire the alert email
• P2 extra D1 round-trip — chargeQuota ran UPSERT then SELECT; collapsed to one batched statement
• P2 serialized Class B charges — streamSessionBatches charged per object in the loop

Plus P3 polish (DO emits X-Quota-Breach-Date, res.clone() in passthrough, CAP sanity check, jitter on retry backoff, cleanups).

Changes by file

• storage/r2.ts — new listBlobs / getBlob / deleteBlob wrappers that charge quota; streamSessionBatches batches Class B; split putBatchJsonl into encodeBatchJsonl + putBatchJsonlBytes so the DO can dedup charges on retry
• ingest-do/session-ingest-do.ts — tracks chargedSeq in DO storage (persisted before R2 PUT), skips the charge on retry; emits X-Quota-Breach-Date header on first-breach 429
• quota/daily-quota.ts — UPSERT with CASE-based conditional latch flip inside a db.batch that also captures the pre-snapshot; halves D1 round-trips and closes the double-email race; adds CAP_* > 0 load-time assertion
• quota/http.ts — guardWaitUntil wraps every scheduled task; scheduleDoAlert now reads the D1 row keyed on the DO-emitted breach date; removed unused exports
• auth/email.ts — shared postToResend with 5s AbortSignal + jittered retry; used by both sendMagicLink and sendOperatorAlert
• ingest/tree-builder.ts, routes/sessions.ts (DELETE), routes/wpilog.ts (post-regen GET) — switched to the charged wrappers; wrapped callers in try/catch for QuotaExceededError
• routes/telemetry.ts — res.clone() before passing to scheduleDoAlert

Test plan

• pnpm typecheck — both web + worker clean
• pnpm test — 125 worker + 12 web pass (was 124 worker; added a concurrent-race unit test that asserts exactly one firstBreach=true across N concurrent chargeQuota callers)
• Post-deploy: trigger a /data batch that crosses CAP_BYTES (or use a temporarily lowered constant) and verify one and only one operator email arrives
• Post-deploy: check Wrangler tail for [quota/scheduleAlertAndAudit] waitUntil task threw if anything fails — previously silenced

Residual findings not addressed here (advisory only)

• Cross-tenant DoS via global counter — documented tradeoff; single stolen key can 429 every other workspace until midnight. Revisit when a per-workspace billing model exists.
• 3 alert emails per UTC day possible — attacker crossing bytes, then Class A, then Class B caps in sequence. Collapsing to a single alerted_today flag would lose per-metric signal.
• Pre-charge before R2 PUT — documented as "safety rail, not ledger"; acceptable drift.
• No admin endpoint to query current counters — agent-native gap; follow-up work.