feat(quotas): compute / network / blockstorage project quota resources

[PF9-pushkar]

Summary

Adds per-project quota management (Phase 3), ported from terraform-provider-openstack v3.4.0:

Resource	Service	Fields
pcd_compute_quotaset	Nova	cores, ram, instances, key_pairs, metadata_items, server_groups, … (14)
pcd_networking_quota	Neutron	network, subnet, port, router, floatingip, security_group[_rule], rbac_policy, subnetpool (9)
pcd_blockstorage_quotaset	Cinder	volumes, snapshots, gigabytes, per_volume_gigabytes, backups, backup_gigabytes, groups (7)

Design

• Partial management. Every quota field is Optional+Computed with UseStateForUnknown. Only fields the user sets/changes are PUT (*int + omitempty); the server echoes the rest and they stay stable across plans. Setting a field to 0 sends 0; -1 means unlimited (Neutron).
• No create API. Create calls Update then reads the values back (same as upstream).
• Delete is a deliberate no-op — matches upstream schema.RemoveFromState: destroying the resource stops managing the quotas but does not reset them to defaults. gophercloud's reset-to-defaults Delete is intentionally not called.
• Import: composite <project_id>/<region> id, tolerating the legacy bare <project_id>; project_id and region are ForceNew.

Deliberate deferrals (see DECISIONS.md)

• Cinder volume_type_quota (per-volume-type quota map via gophercloud Extra) — the most bug-prone part of the port (echo-on-write, read-back-only-for-configured-keys). Deferred so the scalar quotaset ships clean.
• Nova force and Neutron trunk — exist in gophercloud but not in the upstream schema; omitted to match upstream exactly.

Adversarial review — 2 real bugs found and fixed

A review workflow (3 finder dimensions → adversarial verify each, against Terraform core source) confirmed two defects, both fixed in this branch, both present in all three resources:

1. readInto error not returned (Create/Update). A transient read-back failure after a successful Update left unknown Computed fields in state; Terraform core's ungated IsWhollyKnown check then raised a spurious "invalid result object after apply". Now Create/Update return on a read-back error.
2. Explicit region = "" thrashed. Create resolved region with IsNull()||IsUnknown() while Read/Update used == "", so an explicit empty region flipped to config.Region on refresh and (region being ForceNew) forced a perpetual replace. Unified on the IsNull()||IsUnknown() predicate everywhere — the verifier flagged that the naive "fall back on empty" fix would instead cause "inconsistent result after apply".

Testing

• go build, go vet, gofmt, golangci-lint — clean (0 issues); unit tests pass; terraform fmt clean; docs regenerate cleanly with correct subcategories (Compute / Networking / Block Storage).
• Per-service acceptance tests (TestAccComputeQuotaset, TestAccNetworkingQuota, TestAccBlockStorageQuotaset): create a project → set quotas → verify via the API → update a field → import. Not run live this session (CE lab credentials unavailable); tracked PENDING in DECISIONS.md.