Per-user-per-project compute resource quota

## Overview

Allow per-user compute resource constraints within a project. Domain/superadmins set project-level resource constraints, and project admins can further subdivide those constraints on a per-user basis.

## Motivation

Current resource constraints are managed via `UserResourcePolicy` (global per-user), `KeyPairResourcePolicy` (per access key), and `ProjectResourcePolicy` (per project). However, there is no way to assign **different resource limits to individual users within a specific project**, preventing project admins from fine-grained resource allocation.

## Design

### New Entity

`ProjectUserResourceQuota` (tentative) — stores per-project-per-user compute resource constraints.

### Resource Constraint Hierarchy

```
UserResourcePolicy (global per-user)
↕ min (stricter one wins)
ProjectUserResourceQuota (per-project-per-user)
↑ bounded by
ProjectResourcePolicy (project-wide constraint)
```

### ResourceGroup Granularity

- Can be further refined per ResourceGroup
- If no per-ResourceGroup setting exists, the constraint applies across all ResourceGroups in the project

### Default Behavior

- If no explicit per-user setting exists for a project, the project-wide constraint (`ProjectResourcePolicy`) applies as-is
- No equal distribution among users

### Management Scope

|Role|Permission|
|---|---|
|Superadmin / Domain admin|Set project resource constraints|
|Project admin|Set per-user resource constraints within the project's limits|

## Scope

- Compute resources only (CPU, memory, GPU, etc. via resource slots)
- Storage quota is handled in a separate issue

## NOT Covered

- Storage (vfolder) quota
- Equal distribution of resources based on user count
- Cumulative usage limits (time-based quota)

JIRA Issue: BA-4476