feat: add per-org memory admission limits

[EDsCODE]

Summary

• add an org-level max_memory Kubernetes quantity to the config schema, admin API, monitoring response, and admin UI; empty or zero remains unlimited
• charge each admitted session for its resolved worker pod memory and enforce the aggregate org memory ceiling atomically alongside the existing vCPU budgets
• preserve FIFO and hard-rejection behavior, add bounded metrics and operational documentation, and reject hot-idle workers whose live pod resources no longer match the shape admission charges

Test plan

• just ci
• just ui-test
• just test-controlplane-k8s
• just lint
• git diff --check

Rollout

Leave max_memory unlimited until every control-plane replica is running this version and legacy active leases with zero recorded memory have drained. After a non-zero cap is enabled, prefer roll-forward; clear all memory caps before rolling back to an older binary.

[github-actions]

Test Impact Plan

Deterministic summary of how this PR changes tests, CI runners, and coverage-risk signals.

Summary

Area	Added	Changed	Deleted
Test files	1	15	0
E2E/journey files	0	0	0
Workflow files	0	0	0

Signals

• Test cases: +23 / -0
• Assertions: +121 / -2
• Skips or known failures added: 0
• Workflow continue-on-error added: 0
• Workflow path filters added: 0
• Test commands removed from justfile: 0
• E2E/journey retry lines added: 0

Coverage risk: neutral or increased

No coverage-reduction warnings detected.