Preflight passes but deployment fails on quota and Key Vault name length, after billable resources are created

### Summary

Three related gaps in `kars up`: the default node footprint exceeds a default Azure subscription's quota, `baseName` length is not validated against the Key Vault naming limit, and neither is caught by preflight — so both failures happen only after billable resources exist, with no rollback.

### Version

`@kars-runtime/cli@0.1.26`

### 1. Default footprint exceeds a default subscription's quota

```
ErrCode_InsufficientVCPUQuota: requested 16, remaining 10 for family
standardDSv3Family for region westus3
```

The template requests 16 vCPU:

| Pool | Count | Source | vCPU |
|---|---|---|---|
| `system` | 2 | hardcoded in `modules/aks.bicep` | 4 (at D2s_v3) |
| `clawpool` | `nodeCount`, default 3 | `main.bicep` | 12 (at D4s_v3) |

A default Azure pay-as-you-go subscription carries 10 vCPU per family. `nodeCount` is a Bicep parameter but is **not exposed as a `kars up` flag**, and the system pool count is hardcoded — so the footprint cannot be reduced through any supported interface.

This means the documented "one command to go from zero to production" cannot succeed on a default subscription without a prior quota increase.

### 2. `baseName` length is not validated

```
VaultNameNotValid: The vault name '-kv-<6-char-suffix>' is invalid.
A vault's name must be between 3-24 alphanumeric characters.
```

`main.bicep` builds the vault name as `'${baseName}-kv-${kvSuffix}'` with a 6-character suffix, so `baseName` must be 14 characters or fewer. A 15-character `--cluster-name` fails. The constraint is not documented in `kars up --help` and is not checked by preflight.

### 3. Failures leave billable resources behind

Both failures occur after ACR, Key Vault, Log Analytics, Application Insights and an **Azure OpenAI account** have been created. There is no rollback. The Azure OpenAI account additionally soft-deletes and needs an explicit `az cognitiveservices account purge` before the name and quota are freed.

### Suggested fixes

- Validate `baseName` length in preflight against the Key Vault 24-character limit (cheap, deterministic).
- Check available vCPU quota for the chosen family and region in preflight, comparing against the computed footprint, and fail before creating anything.
- Expose `--node-count` and a system-pool count, or lower the defaults so a default subscription can complete a first deploy.
- Consider deploying AKS before the supporting resources, or offering a `--rollback-on-failure` option, so a failed run does not leave a billable OpenAI account behind.

Start with the preflight path for `kars up`, then inspect `main.bicep` and `modules/aks.bicep` to trace the Key Vault name and node-footprint inputs. Review `kars up --help` for currently exposed parameters and identify how quota and name checks can be verified before resource creation. Done means the documented failure cases are detected before billable resources are created and the supported configuration reflects the intended defaults or limits.

Written by the indexing model from the issue text.