Scaling Phase 1: multi-tenant onboarding + replica-safe coordination

Decouples "many users" + "many server replicas" from "many machines" so the
platform is tenant-isolated and horizontally safe on the current single node.

- Per-signup workspaces (cm-auth): a new hosted-identity sign-in provisions and
  owns its own workspace instead of joining the first. Config-gated by
  auth.per_signup_workspace (default off); concurrent first-logins serialized by
  a per-subject advisory lock so no duplicate workspaces.
- Terminal tickets in Postgres (migration 0016, hashed, single-use): any replica
  can redeem a ticket minted by another. Drops the in-process ticket map.
- Container registry in Postgres (migration 0017, agent_containers): Terminal
  and Sandbox managers resolve an agent's container through a shared registry,
  so a 2nd replica reuses it instead of spawning a duplicate. node_id recorded
  as 'local' (Phase 2 hook). Boot reconcile removes only true orphans, so
  terminals now survive a redeploy (tmux sessions resume).
- Per-workspace quotas (cm-api/quota.rs): plan-tier caps on agents + live
  containers, enforced at agent create + terminal spin-up (reconnects allowed),
  returned as HTTP 402. New GET /api/quota surfaces usage vs limits.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/bins/clawmates-server/src/main.rs

@@ -153,11 +153,18 @@ async fn run() -> Result<(), String> {
                     std::sync::Arc::new(driver);
                 let agents = std::sync::Arc::new(cm_runtime::SandboxManager::new(
                     driver.clone(),
+                    pool.clone(),
+                    "local",
                     &config.sandbox.image,
                 ));
                 let browser = std::sync::Arc::new(
-                    cm_runtime::SandboxManager::new(driver.clone(), &config.sandbox.browser_image)
-                        .with_egress(),
+                    cm_runtime::SandboxManager::new(
+                        driver.clone(),
+                        pool.clone(),
+                        "local",
+                        &config.sandbox.browser_image,
+                    )
+                    .with_egress(),
                 );
                 // Themed interactive terminal containers (zsh + oh-my-zsh + p10k)
                 // for the Terminal computer app. On the Local storage backend the
@@ -172,6 +179,8 @@ async fn run() -> Result<(), String> {
                 };
                 let terminals = std::sync::Arc::new(cm_runtime::TerminalManager::new(
                     driver,
+                    pool.clone(),
+                    "local",
                     &config.sandbox.terminal_image,
                     config.sandbox.terminal_egress,
                     drives,
@@ -276,6 +285,7 @@ async fn run() -> Result<(), String> {
                 (config.storage.backend == cm_config::StorageBackend::Local)
                     .then(|| PathBuf::from(&config.storage.data_dir)),
             )
+            .with_per_signup_workspace(config.auth.per_signup_workspace)
             .pipe_auth_verifier(auth_verifier),
     );
     if e2e::enabled() {