feat(apps): show owner-site quota usage and structured quota errors

[nandiheath]

When Compose refuses a new deployment at the owner's site limit, bl apps drops the usage, allowance and structured recovery fields. Preserve those fields alongside the existing HTTP status, trace ID and manifest validation guidance so callers can inspect capacity and choose an explicit retry.

Recovery sanitization applies only to errors: successful debug logs and deletion metadata remain intact. The quota guidance also reflects held failed-deploy reservations and quota_cleanup_pending, which must not be treated as released capacity.

The original sanitizer reproduced three process regressions, including delete_outcome_unknown after a successful response. These pass with the fix, as do just check and just package-smoke. Process fixtures verify a realistic capped deploy retains its quota fields and trace without retrying the mutation; a read-only Public staging owned-list check also passed.

Customers receive this through a rebuilt CLI or Blox image after merge.

[jonwinton]

redact_json_value sanitizes successful responses as well as errors (authorized_json_request, delete_app), so the change at src/bl/apps.rs:1533 affects every successful Apps Platform response, not only the error recovery fields:

• String values now go through terminal_safe_text, which rewrites newlines, tabs, and other control characters as literal Rust-style escapes (\n becomes the two characters \ n, ESC becomes \u{1b}). print_json already emits valid JSON with bidi controls escaped, so --json consumers only lose data. For example, multi-line pod logs from bl apps debug --json now arrive as a single line with literal \n sequences. The updated contract process test (nested.message expecting \\u{1b}[31m) reflects this change on the success path.
• The stricter key check at line 1541 also applies to successful responses. A key containing any control or bidi character now fails the whole command. For delete, that surfaces as "delete outcome unknown" after a request that may have succeeded.

Consider applying terminal-safe escaping and the unsafe-key rejection only inside sanitize_field (error details and next_action), and leaving redact_json_value as credential redaction for successful responses.

Separately, the DCO check is failing; the commit needs a Signed-off-by trailer.