Enforce the Devii task quotas with atomic reservations

The creation and run quotas were checked and then acted on, so two concurrent
create_task calls or two schedulers could both pass the check and overshoot the
limit. Both are now a single conditional INSERT decided on the driver rowcount:
reserve_run takes a run slot after the claim and releases the claim by deferring
when the quota is spent, and insert_task_within_quota does the same for the task
row itself. Racing twelve and sixteen processes now yields exactly the limit.

The atomic insert names its columns, and dataset skips a None valued key when it
creates a table lazily, so the store declares the full task column set up front.
Both the column and index ensures now tolerate a concurrent duplicate, since
several processes build a store at once and SQLite DDL is not idempotent.

Adds the quota, task-run context, guard, store and scheduler test suites, and
documents the chokepoints and the unhackable task-run flag.

tests/unit/services/devii/session.py

@@ -90,6 +90,7 @@ def test_scheduled_tasks_only_ever_resolve_a_main_channel_session(local_db):
                 "role": "Admin",
                 "api_key": "k",
                 "deleted_at": None,
+                "created_at": "2099-01-01T00:00:00",
             }
         )
         database.invalidate_admins_cache()
@@ -135,51 +136,35 @@ def test_task_run_block_is_absent_outside_a_scheduled_run(local_db):
     assert "TASK RUN ENVIRONMENT" not in session._compose_system_prompt()
 
 
-def test_member_session_is_told_it_may_not_nest_tasks(local_db):
+def _task_session(local_db, uid, role):
     from devplacepy.services.devii.tasks.context import task_run_scope
 
     hub, svc = _hub()
     local_db["users"].insert(
         {
-            "uid": "sess-task-member",
-            "username": "task-member",
-            "role": "Member",
+            "uid": uid,
+            "username": uid,
+            "role": role,
             "api_key": "k",
             "deleted_at": None,
-            "created_at": "2026-01-01T00:00:00",
+            "created_at": "2099-01-01T00:00:00",
         }
     )
     database.invalidate_admins_cache()
     session = hub.get_or_create(
-        "user", "sess-task-member", "task-member", "", svc.instance_base_url(),
-        channel="main",
+        "user", uid, uid, "", svc.instance_base_url(), channel="main"
     )
     with task_run_scope():
-        prompt = session._compose_system_prompt()
+        return session._compose_system_prompt()
+
+
+def test_member_session_is_told_it_may_not_nest_tasks(local_db):
+    prompt = _task_session(local_db, "sess-task-member", "Member")
     assert "TASK RUN ENVIRONMENT" in prompt
     assert "may NOT schedule further work" in prompt
 
 
 def test_administrator_session_is_told_it_may_nest_tasks(local_db):
-    from devplacepy.services.devii.tasks.context import task_run_scope
-
-    hub, svc = _hub()
-    local_db["users"].insert(
-        {
-            "uid": "sess-task-admin",
-            "username": "task-admin",
-            "role": "Admin",
-            "api_key": "k",
-            "deleted_at": None,
-            "created_at": "2026-01-01T00:00:00",
-        }
-    )
-    database.invalidate_admins_cache()
-    session = hub.get_or_create(
-        "user", "sess-task-admin", "task-admin", "", svc.instance_base_url(),
-        channel="main",
-    )
-    with task_run_scope():
-        prompt = session._compose_system_prompt()
+    prompt = _task_session(local_db, "sess-task-admin", "Admin")
     assert "TASK RUN ENVIRONMENT" in prompt
-    assert "MAY" in prompt
+    assert "you MAY" in prompt