feat: cap-aware autoscaler + token-gated whole-instance tag reset (operator feedback)

Autoscaler (agent 2026-07-02.5): the buffer-occupancy signal alone would peg
downloaders at DL_MAX while the bandwidth CAP — not concurrency — is the real
constraint (8 streams sharing 8 MB/s move no more data than 4). Growth is now
gated on the pipe having headroom (net < 85% of cap) and a pipe pinned at the
cap (>= 95%) sheds streams down to 3; dead band prevents flapping. The UI hint
says 'holding at the bandwidth cap' and /status reports bw_capped, so the
behavior is legible without tests that need the ML stack.

Reset content tagging: stays a FULL-instance reset (operator's call), but now
lives in a fenced 'Danger zone' section on Cleanup and the apply is gated by a
preview-derived confirm token (mirrors the Tier-C bulk-delete pattern — stale
counts are rejected server-side). Copy no longer claims suggestions repopulate:
it says plainly the heads' training examples are deleted and re-tagging starts
fresh. Moved out of TagMaintenanceCard into DangerZoneCard.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CDgx8bQS5YrGRK76v8HUnM

frontend/src/stores/admin.js

@@ -101,8 +101,10 @@ export const useAdminStore = defineStore('admin', () => {
     })
   }
 
-  // Destructive: deletes ALL general + character tags so the operator can
-  // re-tag from scratch via auto-suggest. fandom + series preserved.
+  // Destructive whole-instance reset: deletes ALL general + character tags AND
+  // their applications (the heads' training data included) — fandom + series
+  // preserved. dry-run returns a `confirm` token; the apply must pass it back
+  // ({ dryRun: false, confirm }) or the server rejects it.
   function resetContentTagging(opts = {}) {
     return _dryRunPost('/api/admin/tags/reset-content', opts)
   }