Closes the M5 follow-up gap: `UserConfig.budget` was set-via-config.toml
only, but the M6 dashboard already shipped a `UserBudgetPage` stub that
linked back to PR #3203 saying "wire up after M5 lands". M5 has landed
(per-user enforcement is real), so this connects the management plane.

Surface
- `PUT /api/budget/users/{user_id}` — admin-only upsert. Body mirrors
  `UserBudgetConfig` (max_hourly_usd / max_daily_usd / max_monthly_usd /
  alert_threshold). Validates negatives / NaN / infinite + threshold
  range before touching disk so a bad payload returns 400 cleanly. On
  success, `users::persist_users` writes the toml and reloads the kernel
  so the new cap takes effect on the next LLM call.
- `DELETE /api/budget/users/{user_id}` — admin-only clear. Sets
  `UserConfig.budget = None` and persists. Idempotent (cleared user gets
  200, no error).
- Both record a `RoleChange` audit event with the caller's user_id, same
  shape as `update_user`.

Both reuse `require_admin_for_user_budget` (the existing gate on the GET
sibling) — Owner-level isn't required because budget management mirrors
`update_agent_budget` semantically. `users::persist_users` and
`PersistError` lifted from module-private to `pub(crate)` so the budget
handler can share the same toml-write path that user CRUD uses.

Dashboard
- `api.ts`: `UserBudgetResponse` retyped to match the actual server shape
  (`{user_id, name, role, hourly{spend,limit,pct}, daily{...},
  monthly{...}, alert_threshold, alert_breach, enforced}`). The previous
  shape was an M5-stub guess that never matched the wire format.
- New `useUpdateUserBudget` / `useDeleteUserBudget` mutations; both
  invalidate `userBudgetKeys.detail(name)` plus `userKeys.detail(name)`
  + `userKeys.lists()` since `UserConfig.budget` is part of `UserItem`.
- `UserBudgetPage` rewritten from stub to live editor: spend bars per
  window, limit / threshold form, validation (negative / out-of-range)
  matched to server; "Clear cap" button that calls DELETE.

Tests
- `test_user_budget_put_get_delete_round_trip`: PUT 1.5/12/100 USD
  caps, assert GET reflects them, DELETE, assert GET is back to 0.
- `test_user_budget_put_rejects_invalid_payload`: -1.0 hourly,
  threshold=1.5, threshold=-0.1 — all 400.
- `test_user_budget_put_rejects_viewer_with_403`: Bob (viewer) PUT
  against Alice → 403, gate from in-handler `require_admin_for_user_budget`.
- `test_user_budget_put_unknown_user_returns_404`: PUT against
  NonExistent surfaces 404 instead of silent insert.

Addresses review on #3224:

1. cargo fmt — collapsed two split format!() literals on budget.rs that
   tripped the Quality CI check.
2. PUT /api/budget/users/{id} now rejects partial bodies with 400
   instead of silently zeroing missing windows. UserBudgetConfig has
   #[serde(default)], so a previous `{"max_hourly_usd": 5}` would have
   reset daily/monthly/alert to defaults — clearing an existing cap
   without warning. Also rejects wrong-typed values (`"1.0"` as a
   string) with 400 instead of coercing to 0.0.
3. Audit detail now records the target user_id alongside the new
   values, so "who changed Bob's budget" is one log line instead of a
   timestamp+number-fishing exercise.
4. AuditAction switched from RoleChange → ConfigChange. RoleChange is
   reserved for admin/editor/viewer flips; budget edits are config
   changes. Keeps the audit filter clean.

New regression test test_user_budget_put_rejects_partial_payload pins
all four shapes that must 400: missing key, multiple-missing, empty
object, and string-typed number. Existing 404 / 403 / round-trip /
invalid-value tests updated to send full-shape bodies.

# Conflicts:
#	crates/librefang-api/tests/api_integration_test.rs

…-write-api

# Conflicts:
#	crates/librefang-api/tests/api_integration_test.rs