feat: enforce shared application resource quotas across namespaces

internal/transport/httpserver/application_resources.go

@@ -0,0 +1,32 @@
+package httpserver
+
+import (
+	"net/http"
+
+	"git.yuntuo.hk/k2safe/orbit/platform/auth"
+	"git.yuntuo.hk/k2safe/orbit/platform/resources"
+)
+
+// RegisterApplicationResources 只操作已认证凭据所属应用，不接受请求体覆盖归属。
+func RegisterApplicationResources(server *http.Server, s *resources.Service) {
+	mux := server.Handler.(*http.ServeMux)
+	mux.HandleFunc("GET /v1/application/resources", wrap(func(r *http.Request, t auth.Token) (any, int, error) {
+		if _, err := historyQuery(r, false); err != nil {
+			return nil, 0, err
+		}
+		out, err := s.Get(r.Context(), t)
+		return out, 200, err
+	}))
+	mux.HandleFunc("POST /v1/application/resources:configure", wrap(func(r *http.Request, t auth.Token) (any, int, error) {
+		var in resources.ConfigureInput
+		if err := decodeBody(r, &in); err != nil {
+			return nil, 0, err
+		}
+		key, err := idempotencyKey(r)
+		if err != nil {
+			return nil, 0, err
+		}
+		out, err := s.Configure(r.Context(), t, key, in)
+		return out, 200, err
+	}))
+}

internal/transport/httpserver/tasks.go

@@ -189,7 +189,7 @@ func writeError(w http.ResponseWriter, id string, err error) {
 	if status == 0 {
 		status = 503
 	}
-	if known.Code == "QUEUE_FULL" {
+	if known.Code == "QUEUE_FULL" || known.Code == "APPLICATION_FULL" {
 		status = http.StatusTooManyRequests
 		w.Header().Set("Retry-After", "1")
 	}