fix: count daily quota against the org that owns the limit

[Priyanshu-u07]

The daily limit comes from an org-wide policy. The query says so:

    (DBPolicy.org_id == org_id) & (DBPolicy.deployment_id.is_(None))

but the Redis counters were keyed on user_id, which is apikey:<id> for an API-key request. Each key got the whole org's allowance to itself, so an org with five keys could spend five times its limit.

Both sides now resolve the same scope through one helper, and the key is built in one place because a limit counted against a different key than it is enforced on is not a limit.

increment_redis_only gained a db parameter. It had no way to turn an API key into an org on its own, and router.py already had a session. The alternative carrying the org from the resolved context would have meant a wire-format change across the inference boundary for a bug that lives inside the policy engine.

Identities that are not API keys fall back to their own id. That is narrower than an org, so a sandbox token cannot spend someone else's quota.

On deploy

Counters under the old key shape are orphaned rather than migrated. They are daily keys and age out on their own, but every org starts that day from zero regardless of what it has already spent. Deliberate: migrating the would mean summing each org's keys at an arbitrary moment, and the result would be wrong in a different way.

Closes #347