AI quota notice and per-visitor rate limits

When app AI calls run out, viewers now see a clear quota notice (shown once per app view). The upgrade CTA appears only for personal workspaces, and visitors of public apps can now use AI against their own workspace. Per-visitor rate limits (20/min, 200/hour per app) prevent a single visitor from draining a workspace's quota.