fix: hide exact quota values from account response (#16)

Closes #1

- hide exact quota values from GET /api/account
- keep only the approximate quota bucket in the public account payload
- add a regression test for the public account response contract
- document that completed tasks should end with a PR

Co-authored-by: sirily <sirily@git.shararam.party>
Reviewed-on: #16

AGENTS.md

@@ -44,3 +44,15 @@ This repository is a TypeScript monorepo for `nproxy`, a crypto-subscription ima
 - If you change deployment assumptions, update `docs/ops/deployment.md`.
 - If you change Telegram admin auth, update `docs/ops/telegram-pairing.md`.
 - If you change failover, cooldown, or balance logic, update `docs/ops/provider-key-pool.md`.
+
+## Workflow
+- At the end of each completed task, create a PR for the changes unless the user explicitly says not to.
+
+## Gitea Workflow
+- Treat the remote Gitea repository as the source of truth for task tracking when the user refers to `issues`.
+- Before starting implementation, open the relevant Gitea issue and read its full problem statement and acceptance criteria instead of guessing from local notes.
+- If the user asks to "continue work" or pick the next task, inspect the open Gitea issues and choose the first one that is logically ready to implement.
+- After finishing the task, push the branch and create a Gitea PR linked to the issue.
+- Every task PR must include an issue reference in the PR body, usually `Closes #<issue-number>` (or `Refs #<issue-number>` when it should not auto-close on merge).
+- If the issue-to-PR link is not clearly visible in Gitea, add an explicit comment in the issue with the PR number and URL.
+- If Gitea access requires credentials or network escalation, use the configured repository environment and approved escalation flow instead of skipping the issue lookup.