Code mode: Cloud run quotas (monthly cap + per-org concurrency) before Cloud enablement #1491

Last code-side gap before enabling code mode on Cloud (see the activation plan). Cloud is multi-tenant: the per-run limits (deadline, memory, tool-call cap, output cap) bound a single run but not a tenant's volume or burst against the shared runner.

Scope

• Monthly run cap per plan (abuse + monetization), authoritative from the code_runs table so it is correct with or without Redis. Defaults: trial 100, Starter 500, Team 5,000, Business 5,000, Enterprise unlimited (a contract may override via a licence feature). A card-backed trial is treated as Team (reuses effectiveCodeModePlan).
• Per-org concurrency cap (noisy-neighbour protection for the shared runner), best-effort via the existing Redis (incr/decr + safety TTL); skipped when Redis is down. Defaults: trial/Starter 1, Team/Business 3, Enterprise 10.
• Cloud only: self-hosted is single-tenant and not metered by runs, so enforcement is a no-op there (isCloud guard).
• Enforced at the single run chokepoint in DynamicMcpTools.executeCodeTool and executeInlineCode, before handing to the runner; over a cap returns a clean QuotaExceeded error. A global runner pool/queue is a possible follow-up.

Files

• license/code-run-quotas.ts (new, pure cap tables + lookups).
• license/license-guard.service.ts: expose the effective code-mode plan for an org.
• mcp-server/dynamic-mcp-tools.ts: acquire/release a run lease around the executor call (reuses already-injected prisma/redis/deployment/licenseGuard — no ctor change).
• Tests + docs + llms.

No Prisma/schema change (uses the existing code_runs table and Redis). Cloud + self-hosted behaviour stated.