Response quota in chat, and a remembered model

Chat now tells people where they stand and stops forgetting their choices.

The quota, visible

Both the empty-state composer and the thread composer show AI responses used against the plan limit. When a plan's monthly cap is actually enforced and reached, the composer shows a short note with a link to billing. It no longer shows the raw server error. A plan that bills overage is never shown as used up.

Cost control

Every model in the registry must now declare limits.maxOutputTokens, and the registry rejects one that does not. The web-search model on Ultra is capped at 16,384 output tokens. Each response stores its input, output, and total tokens on the usage event, so you can see what a conversation really cost.

The picker remembers

The chosen model used to reset to the default on every refresh or new chat. It is now saved on the user as preferredChatModel and restored everywhere. Unknown, disabled, and web-search models are rejected when saving, and a model that was retired falls back to the default. On a plan without access to premium models, the default is sent, but a stored premium choice is kept for when the plan upgrades. A support admin impersonating a user can switch models for that session without changing the user's saved choice.