Persist Apps Script quota quarantine across restarts

[poulcarlsen53]

Summary

Adds optional persistence for confirmed Apps Script quota exhaustion.

When a relay response body is classified as quota exhaustion, the client quarantines that deployment/account until the local quota reset estimate and writes the quarantine state atomically. On restart it restores only still-active quota quarantines. Transient network failures and generic HTTP 403s remain normal bounded backoff, so this should not turn permission mistakes or temporary errors into all-day lockouts.

Why

In multi-deployment setups, restarting the client while one account is quota-dead can immediately hammer the bad account again and make healthy deployments feel worse. Persisting only confirmed quota walls lets the client avoid known-dead accounts after restart while keeping transient failures recoverable.

Details

• Adds quota_state_path to the client config. The default is .goose-quota-state.json beside the client config; an empty value disables persistence.
• Uses account-scoped quarantine when script_keys include account labels.
• Falls back to a URL hash when an endpoint is unlabeled, so unlabeled deployments do not accidentally poison each other.
• Writes the state file atomically on Windows and Unix-like systems.
• Adds endpoint stats output showing active quota reset timing.
• Keeps generic 403 handling as bounded backoff rather than persistent quota quarantine.

Validation

• go test -count=1 ./internal/carrier ./internal/config
• go test -count=1 ./...