#954 Admin surface for per-tenant LLM token quota (hw.llm.tokens) + enable [tokengate] llm_token_quota

EARS: The platform admin shall be able to set a per-tenant hw.llm.tokens quota (TokenGate quota policy in the tenant plan; hw.plan.<tenant> sync preserves non hw.tool.* policies). When [tokengate] llm_token_quota=true, call_llm shall reserve (ttl 600, renew 180s), commit actual, release on failure. Code path landed in #928 behind the flag (default off); no API surface yet. Also: exercise a real long hold (>1h, 20+ renewals) before enabling.