fix(quotas): keyless agent chat bucket, keep disabled policies disabled, cached rates

- check_usage treats a request through a keyless (draft) agent as agent
  traffic, matching how its usage rows are bucketed and the headless rule
- dashboard edits carry the stored enabled flag instead of re-enabling the
  policy; disabled policies are labelled in the Quotas tab and the editor
- quota 429s send x-should-retry: false so OpenAI SDK clients do not retry
  a refusal that cannot succeed before the reset
- cached-input and cache-write rates for Anthropic, OpenRouter and Groq
  gpt-oss-120b; refresh OpenRouter deepseek-v3.2 list prices
- UsageQuota reuses usagePercent; docs note that a user override needs an
  existing user

docs/content/Deploying/Usage-Quotas.mdx

@@ -97,7 +97,7 @@ Every admin endpoint requires the admin role, and every change is written to the
 | `GET` | `/api/admin/quotas` | All policies by layer, the current window, and used models without a price. |
 | `PUT` `DELETE` | `/api/admin/quotas/instance` | The instance default. |
 | `GET` `PUT` `DELETE` | `/api/admin/quotas/teams/<team_id>` | A team's per-member allowance. |
-| `GET` `PUT` `DELETE` | `/api/admin/quotas/users/<user_id>` | A user's override. `GET` also returns the limits the user ends up with, the layer each came from, and their usage. |
+| `GET` `PUT` `DELETE` | `/api/admin/quotas/users/<user_id>` | A user's override; the user must already exist (SCIM-provisioned, or signed in once), otherwise `404`. `GET` also returns the limits the user ends up with, the layer each came from, and their usage. |
 | `GET` | `/api/user/quota` | The caller's own limits, usage and reset time. |
 
 A `PUT` body sets, per budget, a limit or the unlimited flag; leave both out to defer to the next layer: