feat(drive): add quota calculus per drive

- quota per drive
    - add 2 internal API endpoints to test purpose
        disabled by default, enable it via `OXICLOUD_ENABLE_ADMIN_INTERNAL_ENDPOINTS=true`

        this enable:

            /api/admin/internal/trigger-sweep
                to sweep the trash and recalculated quota

            /api/admin/internal/trigger-gc
                to garbage orphan blobs

        use full for end to end tests and validate lifecycles

src/interfaces/api/handlers/file_handler.rs

@@ -267,7 +267,7 @@ impl FileHandler {
                 {
                     upload_ingest::discard_ingested(dedup, &ingested).await;
                     tracing::warn!(
-                        "⛔ UPLOAD REJECTED (quota): user={}, file={}, size={}",
+                        "⛔ UPLOAD REJECTED (user quota): user={}, file={}, size={}",
                         auth_user.username,
                         filename,
                         ingested.size
@@ -275,6 +275,31 @@ impl FileHandler {
                     return Err(Self::quota_error_response(err));
                 }
 
+                // ── Per-drive quota enforcement (D4) ─────────────────
+                // Sibling to the per-user check above: same read-only
+                // SELECT shape, same discard-then-507 outcome. Skipped
+                // when there's no folder_id (root-level upload — no
+                // drive to charge; folder service refuses these
+                // independently). Unlimited-quota drives (`NULL`)
+                // short-circuit inside the service.
+                if let Some(storage_svc) = state.storage_usage_service.as_ref()
+                    && let Some(fid_str) = folder_id.as_deref()
+                    && let Ok(fid) = uuid::Uuid::parse_str(fid_str)
+                    && let Err(err) = storage_svc
+                        .check_drive_quota_by_folder(fid, ingested.size)
+                        .await
+                {
+                    upload_ingest::discard_ingested(dedup, &ingested).await;
+                    tracing::warn!(
+                        "⛔ UPLOAD REJECTED (drive quota): user={}, folder={}, file={}, size={}",
+                        auth_user.username,
+                        fid,
+                        filename,
+                        ingested.size
+                    );
+                    return Err(Self::quota_error_response(err));
+                }
+
                 // ── Register the file row against the ingested blob ──
                 let hash = ingested.hash.clone();
                 let size = ingested.size;