perf(worker): 按实例内存上限扩展异步容量

将策略推导出的集群目标与单 Worker 内存安全上限分离，避免失活实例的全部容量转移到单个 2 GiB Pod。

生产环境单实例上限和媒体物化并发设为 24；两实例正常时总容量由 16 提升至 48，后续可通过增加 Worker 节点继续扩展。新增 0093 迁移保存实例容量上限，并兼容滚动发布中的旧实例。

风险：更高媒体并发会增加 Worker 和节点内存压力，保留单实例 24 的硬边界并由持续监控观察 RSS、OOM、队列与节点余量。

验证：go test ./... -count=1；go vet ./...；真实 PostgreSQL 分配与故障转移测试；迁移安全检查；kubectl kustomize；gofmt -l；git diff --check。

apps/api/internal/store/admission_queue_integration_test.go

@@ -625,4 +625,17 @@ WHERE instance_id = $1`, secondID, (workerHeartbeatStaleAfter + time.Second).Str
 	if err != nil || first.Allocated != 5 || first.ActiveInstances != 1 {
 		t.Fatalf("single-worker failover allocation = %+v, err=%v", first, err)
 	}
+
+	first, err = db.RegisterWorkerInstance(ctx, WorkerRegistrationInput{
+		InstanceID: firstID, DesiredCapacity: 100, CapacityLimit: 3,
+	})
+	if err != nil || first.Allocated != 3 || first.GlobalAllocated != 3 {
+		t.Fatalf("bounded single-worker allocation = %+v, err=%v", first, err)
+	}
+	second, err = db.RegisterWorkerInstance(ctx, WorkerRegistrationInput{
+		InstanceID: secondID, DesiredCapacity: 100, CapacityLimit: 2,
+	})
+	if err != nil || second.Allocated != 2 || second.GlobalAllocated != 5 || second.ActiveInstances != 2 {
+		t.Fatalf("bounded two-worker allocation = %+v, err=%v", second, err)
+	}
 }