Introduces QuotaManager: a per-subdirectory byte-quota tracker
  backed by redb and an in-memory cache, keyed by the first-level
  subdirectory name under the export root.

  Cache mutations and the redb commit are held under the same write
  lock with rollback on persistence failure, so the cache is never
  observable in a state that was not also persisted. Stored keys are
  validated at ingress and again on load, so corrupted entries with
  path separators or `..` cannot slip into the cache where a later
  scan could escape the export root.

  check_quota returns "Quota exceeded" errors so NFS handlers can map
  them to NFS3ERR_DQUOT.

Signed-off-by: Vicente Cheng <vicente.cheng@suse.com>

  Adds FsStats and Filesystem::statvfs, implemented by
  LocalFilesystem via libc::statvfs in spawn_blocking. The NFS FSSTAT
  handler now reports the real underlying filesystem to clients
  instead of fixed placeholders.

  Byte multiplier prefers f_frsize, falls back to f_bsize when zero,
  with saturating_mul to guard against overflow.

Signed-off-by: Vicente Cheng <vicente.cheng@suse.com>

  Wires QuotaManager into LocalFilesystem. new() takes an
  Option<&QuotaConfig>; when enabled, a manager is opened against the
  configured redb database. BackendConfig gains with_quota().

  The DB path is rejected if it resolves under the export tree —
  otherwise NFS clients could tamper with quota state via normal
  filesystem operations. Containment is checked in absolute terms
  with a normalize_path helper that safely collapses `..`.

  statvfs reports quota-aware byte counts for paths inside a quota
  directory; inode counts and paths outside any quota fall back to
  libc::statvfs.

  Also exposes `pub mod config` in lib.rs and plumbs the quota block
  through main.

Signed-off-by: Vicente Cheng <vicente.cheng@suse.com>

  Wires QuotaManager into write, remove, setattr_size, and rename.

  Accounting is in allocated bytes (st_blocks * 512) rather than
  logical length, closing the sparse-file bypass. Writes pre-check
  data.len() and adjust by the real delta after the operation;
  truncate-down releases space; cross-quota rename walks the source
  footprint once and transfers usage after the rename.

  Two stat helpers carry the semantics needed:
    * allocated_bytes_following — for write/setattr_size, follows
      symlinks just like the kernel-level open does.
    * refundable_bytes_on_unlink — for remove, refunds only for
      regular files with nlink == 1 so symlinks and hard-linked
      files cannot be used to drift the counter below reality.

  quota_target canonicalises the path so a cross-PVC symlink charges
  the PVC where the data actually lives. write and setattr_size
  revalidate the resolved path before opening, blocking stale-handle
  plus symlink-swap escapes from the export.

  Post-FS quota updates are best-effort — a redb error after the
  mutation has succeeded is logged, not propagated. NFS handlers for
  WRITE/SETATTR/RENAME map both "Quota exceeded" and Linux's "Disk
  quota exceeded" to NFS3ERR_DQUOT.

Signed-off-by: Vicente Cheng <vicente.cheng@suse.com>

  Adds scan_and_reconcile and reconcile_all on QuotaManager that walk
  each tracked quota directory, recompute its real byte footprint,
  and overwrite the cached + persisted usage. Repairs drift caused by
  out-of-band changes or lost updates.

  The directory walker is shared with cross-quota rename: the
  previous duplicate path_size and compute_dir_size collapse into one
  allocated_path_size in the quota module, using symlink_metadata so
  the walk cannot escape the subtree.

  The scan runs without the quota lock; the cache update and redb
  commit are serialised under the write lock with rollback on
  failure, preventing a concurrent add_usage between the scan and the
  persist from being silently overwritten.

  LocalFilesystem::start_quota_reconciliation is exposed through the
  Filesystem trait (default no-op) so main can fire-and-forget the
  scan on startup. Missing directories reconcile to zero, and
  per-directory failures are logged without aborting the whole pass.

Signed-off-by: Vicente Cheng <vicente.cheng@suse.com>

  Rounds out folder quota with declarative bootstrap and an
  end-to-end smoke test driven by a real kernel NFS client.

  QuotaConfig gains a [quota.bootstrap] TOML block. apply_bootstrap
  installs each entry only when no quota record exists, so editing
  the block does not clobber tracked usage. Keys are validated via
  the shared validate_quota_dir helper (rejecting empty, ".", "..",
  path separators, NUL bytes). main applies the bootstrap before
  accepting traffic, gated on quota.enabled.

  The QuotaManager module's umbrella `#![allow(dead_code)]` is
  removed now that every method has a runtime caller; remove_quota
  keeps a per-item allow because it is only exercised by tests but
  kept for a future admin path.

  tests/test_nfs_quota.sh exercises under-limit write, over-limit
  EDQUOT, remove-then-write, truncate-then-write, and `df` reporting.
  The CI workflow patches the deployment ConfigMap to enable quota
  and bootstrap a 1MB limit on pvc-quota-test (with the redb file
  kept outside the export so it cannot be tampered with over NFS),
  then runs both the smoke test and nfstest_posix.

  arcticwolf.example.toml documents the new [quota] section.

Signed-off-by: Vicente Cheng <vicente.cheng@suse.com>