feat(billing): enforce image generation quota with admin API and user display

Add period_images_bonus and ledger tracking, gate image_make on remaining quota,
expose admin image-quota routes, show remaining image quota in the balance popover,
and document that admin UI must live in memind_adm (5174) not ops.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/portal-agent-services-bootstrap.mjs

@@ -26,6 +26,7 @@ export async function bootstrapPortalAgentServices({
   apiSecret,
   userAuth,
   sessionAccess,
+  subscriptionService = null,
   mindSpaceRuntimeAdapter,
   mindSpaceAssets,
   resolveUserIdByDirKey,
@@ -184,6 +185,7 @@ export async function bootstrapPortalAgentServices({
       assetService: mindSpaceAssets,
       imageMakeClient,
       imageReviewService,
+      subscriptionService,
       env,
       logger,
     });