多用户生产级缺口批：sweep 鉴权、默认配额、默认 executor、 无价 token 上限

- POST /admin/sweep 改走任一项目 maintainer+ 门槛（与备份管理同口径），否则 403，记 admin_sweep 审计；threshold 下限钳 60 秒
- OAuth 建号 created=True 时写默认配额行（默认 $10/月，CLOUD_DEFAULT_QUOTA_USD_MICROS 可调，INSERT OR IGNORE 幂等）；老用户无配额行不受影响
- 建任务未指定且无环境继承时默认 executor=docker（分支继承为空时同理）；CLOUD_DEFAULT_EXECUTOR 可覆盖，空字符串恢复旧行为；命令台下拉默认改为 docker
- 无价模型 token 上限：价目表外模型（默认 terra）成本 usd 为 NULL，USD 配额永不生效；有配额行的用户当月无价 token 达 CLOUD_QUOTA_UNPRICED_TOKEN_CAP（默认 2000 万/月）即停，服务端 402、worker 认领/重试/后续消息同口径；报表仍记 unpriced，不折假美元
- 测试：新增 test_multiuser_gaps 11 个 + test_worker_quota 3 个；全量 cloud 668、host 64、deploy 19 全过

cloud/cost.py

@@ -111,6 +111,26 @@ def price_usd_micros(model, input_tokens, cached_input_tokens,
     return int(round(usd * 1000000))
 
 
+def unpriced_token_cap():
+    """Monthly unpriced-token ceiling for users who have a quota row.
+
+    Models with no price entry (today: the default gpt-5.6-terra and
+    the other relay models) record usd as unknown, so a USD quota
+    alone never binds them -- without this cap a quota user could
+    burn unlimited unpriced tokens. The cap is a volume guardrail,
+    NOT a price: cost reports still show those tokens as unpriced,
+    never converted to fake dollars. Only users with a quota row
+    are capped (no row still means unlimited, as before). Env
+    ``CLOUD_QUOTA_UNPRICED_TOKEN_CAP`` overrides the default
+    20_000_000 tokens/month; unparsable values fall back to it.
+    """
+    try:
+        return max(0, int(os.environ.get(
+            "CLOUD_QUOTA_UNPRICED_TOKEN_CAP", "20000000")))
+    except (TypeError, ValueError):
+        return 20000000
+
+
 _USAGE_SUM_KEYS = ("input_tokens", "cached_input_tokens",
                    "cache_write_input_tokens", "output_tokens",
                    "reasoning_output_tokens", "total_tokens", "completions")