test(quota): qualify three-application distributed quotas

[nerdalert]

Summary

Extends the distributed token-quota topology and first-class qualification to prove three independent application quotas through one shared consumer endpoint.

application-a, application-b, and application-c authenticate with Basic Auth on the same listener. Praxis publishes the verified subject privately; Praxis AI uses that subject as the quota key; Grid routes admitted requests across the shared west, central, and east provider overlay.

This keeps three responsibilities separate:

• Praxis establishes the authenticated subject.
• Praxis AI admits or denies against that subject's distributed token budget.
• Grid selects an eligible provider only after admission.

What the qualification proves

• Three credentials use one endpoint and one quota rule configuration.
• Each authenticated subject receives an independent quota.
• The same subject shares one Valkey-backed budget across both consumer gateways, so scaling replicas does not multiply capacity.
• Exhausting one subject denies it on both gateways while the other subjects remain admitted.
• Missing, invalid, and cross-subject credentials are rejected before provider contact.
• Denied quota requests do not reach a provider.
• Admitted traffic covers all three attributable Grid provider sites.
• Concurrent reservations do not exceed configured reservation capacity.
• Natural window expiry restores admission.
• Quota state survives consumer restart.
• Valkey outage fails closed and recovery restores service.
• NetworkPolicy positive and negative controls hold.
• Accepted and serving overlay revisions converge before traffic.
• Run-owned clusters, networks, and generated Forge state are cleaned automatically.

Topology changes

• Keeps two consumer gateways with identical quota configuration and one shared listener.
• Removes the temporary public identity gateway, projected identity headers, trusted-group filter, and private identity hop.
• Uses key: authenticated_subject with one common rule and Valkey namespace; the verified subject partitions the ledger securely.
• Retains the three provider sites and Grid round-robin overlay.
• Adds run-scoped Forge state and generated-config ignore rules.

Quota contract

Admission is reservation-based because actual response usage is unknown before routing. The enforced invariant is:

active reserved tokens <= capacity

Settlement records actual usage after the response. Actual settled usage may exceed the reservation estimate without indicating over-admission. Provider distribution is sampled independently from tight quota boundaries.

Cross-repository dependencies

This PR is the Grid qualification and reference topology for a contract implemented across repositories:

1. feat(basic-auth): publish authenticated identity praxis#1108 publishes a successfully verified Basic Auth username as private request-local AuthenticatedIdentity.
2. feat(token-rate-limit): key quotas by authenticated subject ai#980 adds key: authenticated_subject, consumes that trusted identity, and hashes it into an opaque quota key.
3. This PR proves three independent subject quotas across gateway replicas and Grid providers.
4. The companion Demos PR packages the same topology for users.

The identity type is authentication-method-neutral. Basic Auth enables this demo now, while JWT/OIDC/OAuth-backed authentication can publish the same identity for reuse by the AI quota filter.

Related to #101 and praxis-proxy/ai#121.
Depends on praxis-proxy/praxis#1108 and praxis-proxy/ai#980.

Validation

Two fresh Kind qualifications passed all 9 scenarios with automatic teardown. Static validation included xtask tests, workspace Clippy, formatting, make test, make doc, make lint, Forge validation, and git diff --check.

Evidence and generated .forge.resolved.*.yaml files are excluded from the commit.

Landing order

Keep this PR open until Praxis #1108 is released and AI #980 consumes that release. Then rebuild the feature-enabled AI image from committed dependencies and rerun the qualification before merge.

Companion demo: praxis-proxy/demos#20.