Add hardware realignment and recoverable storage accounting

[Llewellynvdm]

Hardware allocation existed for runtime endpoints, but operators lacked a read-only review and controlled apply workflow. The storage sampler also discarded every unfinished scan at its 75-second deadline, while independent alert paths repeatedly notified and could report recovery during another failed attempt.

Release-Version: 3.3.0

Merge order: #61 (3.2.11), #63 (3.2.12), then this PR. This branch includes both dependency fixes to keep that sequence conflict-free.

Changes:

• Add getbible resources realign and menu controls: effective CPU/RAM, filesystem headroom, setting ownership, current/proposed allocation, capacity/cleanup evidence, and explicit apply with stale-plan checks, live overlap admission, dry-run protection and honest partial results.
• Preserve deployment-owned caps and explicit endpoint policies; offer a conservative native memory recommendation, with an explicit override for shared hosts. Apply uses normal runtime readiness, reload and drain transactions for changed domains.
• Resume storage scans in bounded slices with disk-backed queues and inode accounting. Preserve completed accounting on interruption/error, expose progress, and coordinate the complete-scan horizon with admission freshness.
• Retain published storage reservations until a complete later scan accounts for their data, preventing sequential publications from reusing unaccounted headroom. Failed export cleanup also retains a committed charge until its remaining files are accounted for.
• Share durable service incidents between OnFailure and telemetry: correct unit names, actual failure details, bounded reminders, and recovery based on newer successful execution plus completed fresh storage accounting.
• Document commands, configuration ownership, scan freshness and operating limits. Telemetry reclamation remains conservative; already ingested spools are not blindly deleted or hidden by a larger allowance.

Validation:

• 81 focused storage, static-publication, service-alert and resource tests passed locally; resource CLI regressions, ShellCheck and Python dependency compatibility passed.
• CI passed on Python 3.12, 3.13 and 3.14, including lint, unit, CLI and nginx/Gunicorn/SSH integration tests.
• Native production-systemd acceptance passed on Ubuntu 24.04 and 26.04. It directly verifies reviewed hardware allocation, actual memory ceilings, continued readiness, preserved nginx master, and a no-op second application.
• Docker upgrade acceptance passed on amd64 and arm64, including offline deployment, hardware alignment, actual runtime settings, no-op repeat and container recreation.
• Dependency security, Dashboard and release-version checks passed.
• The full local Python run exercised 551 tests with one existing /proc process-identity limitation; that limitation also affects two local image/upgrade CLI fixtures. The corresponding complete CI matrix passed on GitHub.

No production server configuration has been changed.