CortexDB 0.12.6 — hosted plans: per-account limits for the cloud

0.12.6 is 0.12.5 plus what the hosted CortexDB cloud needs to run paid plans on one shared server. Nothing changes on an on-prem server: everything below is off unless CORTEX_PLANS=1, and upgrading from 0.12.5 is a drop-in replacement.

Hosted plans (CORTEX_PLANS=1)

Each account is a tenant subtree (org:acct_42) with a plan; an account without one is free.

• Limits that hold. Past a limit a write, a recall or a new tenant answers 402 PLAN_LIMIT_REACHED with details {limit, used, max, plan, subtree, upgrade_url} (resets_at for the monthly recalls), and nothing was done. A bulk is all or none. The plan's rates become the account's per-subtree rate limit (429 SUBTREE_RATE_LIMITED). Forgetting memories makes room again.
• Durable. Plans and tenants are stored beside the per-subtree counters; the month's recalls are kept by those counters (a crash forgets at most one flush interval); the memory count is re-counted from storage. A restart keeps every limit.
• Routes. GET /v1/plan (the caller's own plan, limits and usage), GET / PUT /v1/admin/plans/{subtree} (trusted operator; the website sets plans with it). Responses to an account's token carry its real X-RateLimit-Monthly-Limit, X-RateLimit-Monthly-Remaining and X-RateLimit-Monthly-Reset.
• A billing tenant per account (CORTEX_V1_TENANT_AUDIENCES=1). The hosted server previously stamped every account's token with the deployment's one audience, so an account's own org:acct_<id> records refused it (outside billing tenant default). Now POST /v1/auth/tokens takes tenant (e.g. "acct_45"): the token's audience is cortexdb:tenant:acct_45, honoured only on this server's own minter's tokens, and its grants must lie in org:acct_45. Records that earlier tokens bound to the deployment's tenant move to the account on its first such mint, so existing data stays reachable; a tenant's token can never mint. An account's existing tenants (scopes already in the registry) count against its plan from the first touch.
• CORTEX_DISABLE_ANON_SIGNUP=1 turns the anonymous POST /v1/auth/signup off, so hosted accounts come only from the website. CORTEX_PLAN_UPGRADE_URL sets where a refusal points.

Details: docs/API_REFERENCE_V1.md §6.5, "Hosted plans"; PRODUCTION_CONFIG.md, "Hosted plans".

Docs

PRODUCTION_CONFIG.md no longer describes CORTEX_SUPERKEY or the Turso API-key lookup, which were removed earlier and nothing reads; the generated auth and surface pages describe the per-subtree rate limits and plans that are enforced, and the preset defaults as they are.