Quota port: refund and settle, 429 with Retry-After and resets_at

[ParallelEntrepreneur]

Part of #3. Split: this PR carries only the open-core half of the billing work. Plans, the durable plan quota, Polar checkout, the Polar webhook and metering are hosted-only, so they moved to the private hosted repository (Ghostwritin/ghostwritin-cloud#1). That repository depends on this PR's head commit through an exact git pin. The branch was rebuilt on current main.

What changed (open)

Quota port (ghostwritin-core)

• Quota::reserve returns a Reservation (account, words, period, resets_at).
• Quota::refund(&Reservation) gives a failed rewrite's words back to the same window, never below zero.
• Quota::settle(&Reservation) is new, with a default no-op. It runs after a successful rewrite so a hosted quota can bill what was used. It cannot fail, so it can never fail a finished rewrite.
• Unlimited and DailyWordLimit implement both. DailyWordLimit now takes unix seconds and reports the next UTC midnight as its reset.
• GhostwritinError::QuotaExceeded { resets_at, retry_after } is still 429 / quota-exceeded. BillingNotConfigured and BillingUnavailable are new (both 503).

API (ghostwritin-api)

• handle() reserves before the model call, refunds if the engine fails (the original error is still returned), and settles on success.
• problem() adds Retry-After and an RFC 3339 resets_at to 429s.
• bearer() and problem() are now public, so a hosted module answers the same way.
• New workspace dependency: time (RFC 3339 formatting; already in the graph through the harness).

README: the 429 fields and the refund on a failed rewrite.

Moved to the private repository

• crates/ghostwritin-api/src/billing.rs: PlanQuota, BillingApi (checkout and webhook) and metering, which now goes through settle.
• The Plan enum. Its allowances (500/day, 50k and 250k/month, My voice on Max) are product policy, so it is not in the open core, and Quota::plan() is gone with it.
• The billing wiring in ghostwritin-worker/src/lib.rs (D1 DB binding, the Polar adapter, PlanQuota, mounting BillingApi). The open Worker is unchanged from main.
• The billing tests from tests/routes.rs, the cratefield-adapter-polar and cratefield-adapter-sqlite dependencies, and the README "Plans and billing" section and Worker billing secrets.

Verification (local; Actions is billing-blocked)

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace: green, including the new a_failed_rewrite_refunds_and_a_good_one_settles and the 429 header test
• RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --workspace
• cargo build --target wasm32-unknown-unknown -p ghostwritin-worker