Lock the server down before the editor goes public (#427)

The editor is about to be opened to strangers: a post on Reddit and a
guest access (#428). nginx served the whole workspace and ran every PHP
file in it, the API let anybody guess passwords as fast as they liked,
and one account could fill the disk.

- nginx (shared web stack, outside this repo, backup in
  /root/config-backup-20261015/) hands out only the two pages, dist/,
  public/brand/, the uploads by kind and ending, and api/index.php.
  Everything else under /feuerwerk/ is a 404.
- PHP behind it has display_errors off and no X-Powered-By. Plain HTTP
  forwards to HTTPS, the API refuses it.
- Headers: a Content-Security-Policy without inline code or eval,
  nosniff, frame-ancestors, HSTS, Referrer-, Permissions-, COOP, CORP.
- vite.config.ts writes the same policy into the built pages, so CI
  runs the whole suite under it. Pixi gets by without eval through
  pixi.js/unsafe-eval. The page CSS left its inline style for a file.
- The harness fails a module for anything the policy refuses, from
  Chrome's log and from the page's securitypolicyviolation event.
- LoginThrottle: five wrong passwords from one address within 15
  minutes, and it gets 429 until 15 minutes after the last of them.
  The address is the last X-Forwarded-For entry, the Brandmauer's own.
- Quota: 1 GB per account for uploads, projects and snapshots. Only a
  write that grows the account is refused (413). Admins have no limit.
- A write whose Sec-Fetch-Site says another site is refused (403).
- The session cookie carries Secure, nginx passes HTTPS on.
- showFailure puts the message in as text, not as HTML.
- Every PHP script outside api/ stops unless it runs on the command
  line.
- The video worker sees the checkout read-only and can only write
  data/videos. No capabilities, 2 GB and 256 processes at most.
- tests/php/rights.test.php runs the API under php -S on a scratch
  directory and asks every route as signed out, owner, stranger and
  admin. A route named in api/index.php but missing in the matrix
  fails it. limits.test.php covers the brake and the quota.

Findings:

- tmp/ was readable from outside, with 79 copies of project files.
  Closed on 15.10. at 20:02 with chmod 750. The log back to 11.10.
  shows only our own requests.
- Port 8080 is bound on 0.0.0.0, so the LAN could reach nginx past the
  Brandmauer. Left as it is: the web stack is not this project's.
- npm audit finds nothing in what is shipped. Dev tools (vitest,
  brace-expansion, source-map-js) have advisories, not touched here.

Tests: check 313 files / 4843 tests. PHP limits 21, rights 60,
accounts 56, snapshots 15, releases 20, files 46 (videos 50/51, no
ffmpeg in the web container). e2e on stein2, atx was off: 34+38+41
197/198, the one red check (a click in 41) passes with 41 alone,
27/27. 67 misses frames at 1080p on stein2 with and without this.
Path list from outside: 10 served, 26 refused. ZAP baseline against
the live site: nothing High or Medium under /feuerwerk/.
Counter-checks: rights.test.php without the cross-site guard, the
quota, the brake, the admin check of users, or with an undocumented
route fails each time. A policy without wasm-unsafe-eval fails e2e 41
with the harness's own CSP line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/lib/Quota.php

@@ -0,0 +1,77 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * How much of the disk an account may take (#427): 1 GB for its uploads, its projects and their
+ * snapshots together. Administrators have no limit; the router does not ask for them.
+ *
+ * Only a write that makes an account larger is refused, so one that is full can still save a smaller
+ * project or delete files. Pixel cels are kept apart: they belong to nobody and are small by rule
+ * (`PixelStore::MAX_BYTES`).
+ */
+final class Quota
+{
+    public const BYTES = 1024 * 1024 * 1024;
+
+    /** The upload folders that are counted, each with a folder per account. */
+    private const KINDS = ['textures', 'fonts', 'sounds', 'videos'];
+
+    public function __construct(
+        private readonly string $data,
+        private readonly int $limit = self::BYTES,
+    ) {}
+
+    /** Bytes `$owner` takes up: everything in their upload folder, their projects and their snapshots. */
+    public function usage(string $owner, string $folder): int
+    {
+        $bytes = 0;
+        if (preg_match('/^' . UserStore::FOLDER_PATTERN . '$/', $folder)) {
+            foreach (self::KINDS as $kind) {
+                $bytes += self::sizeOf("{$this->data}/{$kind}/{$folder}");
+            }
+        }
+        $projects = new Store("{$this->data}/projects", $owner);
+        foreach ($projects->listOf($owner) as $project) {
+            $bytes += (int) @filesize("{$this->data}/projects/{$project['id']}.json");
+            $bytes += self::sizeOf("{$this->data}/snapshots/{$project['id']}");
+        }
+        return $bytes;
+    }
+
+    /** Why `$adding` more bytes do not fit, or null when they do (or add nothing). */
+    public function refusal(string $owner, string $folder, int $adding): ?string
+    {
+        if ($adding <= 0) {
+            return null;
+        }
+        $used = $this->usage($owner, $folder);
+        if ($used + $adding <= $this->limit) {
+            return null;
+        }
+        return sprintf(
+            'Not enough space: this account uses %s of its %s',
+            self::megabytes($used),
+            self::megabytes($this->limit),
+        );
+    }
+
+    private static function megabytes(int $bytes): string
+    {
+        return number_format($bytes / 1024 / 1024, $bytes < 10 * 1024 * 1024 ? 1 : 0, '.', '') . ' MB';
+    }
+
+    private static function sizeOf(string $dir): int
+    {
+        if (!is_dir($dir)) {
+            return 0;
+        }
+        $bytes = 0;
+        $files = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($dir, FilesystemIterator::SKIP_DOTS));
+        foreach ($files as $file) {
+            if ($file->isFile()) {
+                $bytes += $file->getSize();
+            }
+        }
+        return $bytes;
+    }
+}