feat: enhance limits

internal/model/user.go

@@ -75,6 +75,13 @@ type User struct {
 	// BannedAt suspends the account when set: RequireAuth rejects the session
 	// and LogIn refuses to issue a new one. nil = in good standing.
 	BannedAt *time.Time `json:"banned_at,omitempty"`
+
+	// Per-user save-limit overrides (admin-settable; nil = use the plan
+	// default). Never serialized raw — surfaced only via the derived `limits`
+	// object in MarshalJSON so the app can render/enforce the right caps.
+	BookmarkLimit          *int `json:"-"`
+	PublicCollectionLimit  *int `json:"-"`
+	PrivateCollectionLimit *int `json:"-"`
 }
 
 // MarshalJSON adds a derived `has_password` flag so the frontend can pick
@@ -84,10 +91,12 @@ func (u User) MarshalJSON() ([]byte, error) {
 	type alias User
 	return json.Marshal(&struct {
 		alias
-		HasPassword bool `json:"has_password"`
+		HasPassword bool       `json:"has_password"`
+		Limits      UserLimits `json:"limits"`
 	}{
 		alias:       alias(u),
 		HasPassword: u.PasswordHash != nil,
+		Limits:      u.EffectiveLimits(),
 	})
 }