fix(billing): add setImageQuota for admin absolute remaining/total

Grant-only bonus adjustments cannot lower capacity below the stored plan
limit; admin set now updates period_images_limit when needed.

Co-authored-by: Cursor <cursoragent@cursor.com>

billing-subscription.test.mjs

@@ -273,6 +273,52 @@ describe('createSubscriptionService', () => {
     });
   });
 
+  describe('setImageQuota', () => {
+    it('lowers remaining below plan limit by reducing period_images_limit', async () => {
+      const subRow = makeSubRow({
+        period_images_limit: 1000,
+        period_images_bonus: 0,
+        period_images_used: 32,
+      });
+      const pool = makePool(subRow);
+      const svc = createSubscriptionService(pool);
+      const result = await svc.setImageQuota('user-1', { remaining: 100 });
+      assert.equal(result.ok, true);
+      assert.equal(result.quota.remaining, 100);
+      assert.equal(result.quota.total, 132);
+      assert.ok(
+        pool._conn.queries.some(
+          ({ sql, params }) =>
+            sql.includes('SET period_images_limit = ?, period_images_bonus = ?') &&
+            params?.[0] === 132 &&
+            params?.[1] === 0,
+        ),
+      );
+    });
+
+    it('raises remaining above plan limit via bonus', async () => {
+      const subRow = makeSubRow({
+        period_images_limit: 50,
+        period_images_bonus: 0,
+        period_images_used: 10,
+      });
+      const pool = makePool(subRow);
+      const svc = createSubscriptionService(pool);
+      const result = await svc.setImageQuota('user-1', { remaining: 45 });
+      assert.equal(result.ok, true);
+      assert.equal(result.quota.remaining, 45);
+      assert.equal(result.quota.total, 55);
+      assert.ok(
+        pool._conn.queries.some(
+          ({ sql, params }) =>
+            sql.includes('SET period_images_limit = ?, period_images_bonus = ?') &&
+            params?.[0] === 50 &&
+            params?.[1] === 5,
+        ),
+      );
+    });
+  });
+
   describe('cancelSubscription', () => {
     it('returns cancelled=true when active sub exists', async () => {
       const pool = makePool(makeSubRow());