fix: hide exact quota values from account response (#16)

Closes #1

- hide exact quota values from GET /api/account
- keep only the approximate quota bucket in the public account payload
- add a regression test for the public account response contract
- document that completed tasks should end with a PR

Co-authored-by: sirily <sirily@git.shararam.party>
Reviewed-on: #16

CONTRIBUTING.md

@@ -8,12 +8,15 @@
 ## Standard Flow
 1. Update local `master`.
 2. Create a task branch from `master`.
-3. Implement the change in that branch.
-4. Run the relevant verification for the change.
-5. Commit the work in that branch.
-6. Push the branch to Gitea.
-7. Open a merge request into `master`.
-8. Merge only after review or explicit approval.
+3. Pick or confirm the target issue in Gitea before implementation.
+4. Implement the change in that branch.
+5. Run the relevant verification for the change.
+6. Commit the work in that branch.
+7. Push the branch to Gitea.
+8. Open a merge request into `master`.
+9. Link the merge request to the issue in the MR body using `Closes #<issue-number>` or `Refs #<issue-number>`.
+10. If the Gitea UI does not show the link clearly, add an explicit comment in the issue with the MR number and URL.
+11. Merge only after review or explicit approval.
 
 ## Branch Naming
 Use short, purpose-driven names, for example:
@@ -31,3 +34,4 @@ Use short, purpose-driven names, for example:
 ## Agent Workflow
 - Codex or any other coding agent must create and use a dedicated branch per task.
 - After task completion, the agent should push that branch and prepare it for a merge request instead of pushing directly to `master`.
+- The agent must ensure the issue is explicitly linked to the merge request before handing off for merge.