feat: raise hosted community limit to fifty (#8186)

## Summary
- Raise the stock relay active ownership quota from 5 to 50 for creation
and ownership transfer. Raise the absolute lifetime quota from 20 to 50
reserved hosts; completed owner deletions still permanently consume
lifetime capacity to bound create/delete host squatting.
- Honor the owner-list `can_create` projection across Desktop settings,
create flow, and onboarding instead of imposing a client-side count.
Display server `quota_used` / `quota_limit` when available; when the
projection is missing, let the server's `limit_reached` decide.
- Cover 49→50 and 50→51 admissions, deleted-owner lifetime exhaustion,
and rendered create gates under 5/50, 0/50 exhausted, and missing
projections.

## Verification
- Desktop full `pnpm test` and `pnpm typecheck` pass after the 50-cap
update; `cargo fmt --all -- --check` passes. Four targeted Playwright
cases and `pnpm build:e2e` passed for the original dynamic-quota change
at the previous commit, before changing test fixtures from 20 to 50.
- `cargo test -p buzz-db --lib` cannot compile here: macOS dyld rejects
the `sqlx_macros` dylib with `mis-aligned LINKEDIT string pool` on this
host before the crate's tests run. CI must validate the DB package.

## Rollout / manual validation
- Confirm `BUZZ_MAX_COMMUNITIES_PER_OWNER` is unset or 50 on **every**
production relay replica; this per-process cached override takes
precedence over the stock default.
- Confirm Builderlab's list/create/transfer proxy passes the relay's
`quota_used`, `quota_limit`, `can_create`, and `limit_reached` without
its own 5-community gate. Its backing implementation is not in this repo
and was not verified here.
- Human test: with an owner at 49 live communities, create the fiftieth,
verify the fifty-first returns `limit_reached`; transfer into an owner
at 49 then at 50 and confirm the same boundary. Check a deleted-owner
account at 0 active/50 lifetime displays the generic limit and disables
creation. This manual check remains outstanding.

---------

Signed-off-by: am <6e30cd56c30e030cd31bb0939b94a7c257c9a09d5ba2d92cf2735da45629f248@buzz.block.builderlab.xyz>
Co-authored-by: am <6e30cd56c30e030cd31bb0939b94a7c257c9a09d5ba2d92cf2735da45629f248@buzz.block.builderlab.xyz>

docs/operator-community-deletion.md

@@ -191,17 +191,21 @@ rejects with `409` and `code: "limit_reached"` (the `error` message keeps its
 `limit_reached:` prefix for older clients):
 
 - **Active:** live ownership plus incomplete owner deletions
-  (`BUZZ_MAX_COMMUNITIES_PER_OWNER`, default 5). A deletion keeps its slot
+  (`BUZZ_MAX_COMMUNITIES_PER_OWNER`, default 50). A deletion keeps its slot
   until logical completion records `completed_at`.
 - **Lifetime:** live ownership plus every non-aborted owner deletion, including
-  completed ones, capped at an absolute 20 regardless of the active limit.
-  Lifetime usage includes live ownership, so no owner can hold more than 20
-  live communities; a `BUZZ_MAX_COMMUNITIES_PER_OWNER` above 20 is
+  completed ones, capped at an absolute 50 regardless of the active limit.
+  Lifetime usage includes live ownership, so no owner can hold more than 50
+  live communities; a `BUZZ_MAX_COMMUNITIES_PER_OWNER` above 50 is
   unreachable, and owner lists would report a `quota_limit` the owner can
   never reach.
   Deleted communities keep their hosts as permanent tombstones, so this bounds
-  create-then-delete host squatting. Aborted deletions restore the community
-  and count only through its live membership.
+  create-then-delete host squatting. At the stock 50/50 caps, every completed
+  owner deletion permanently reduces the maximum number of live communities
+  that owner can subsequently hold: 50 active slots are only possible with no
+  prior owner deletions. Raising the active override cannot restore those slots.
+  Aborted deletions restore the community and count only through its live
+  membership.
 
 Owner-list responses carry `quota_used` (active), `quota_limit` (active), and
 `can_create` (both caps). `can_create: false` is the only signal a client needs: