feat: cap-aware autoscaler + token-gated whole-instance tag reset (operator feedback)

Autoscaler (agent 2026-07-02.5): the buffer-occupancy signal alone would peg
downloaders at DL_MAX while the bandwidth CAP — not concurrency — is the real
constraint (8 streams sharing 8 MB/s move no more data than 4). Growth is now
gated on the pipe having headroom (net < 85% of cap) and a pipe pinned at the
cap (>= 95%) sheds streams down to 3; dead band prevents flapping. The UI hint
says 'holding at the bandwidth cap' and /status reports bw_capped, so the
behavior is legible without tests that need the ML stack.

Reset content tagging: stays a FULL-instance reset (operator's call), but now
lives in a fenced 'Danger zone' section on Cleanup and the apply is gated by a
preview-derived confirm token (mirrors the Tier-C bulk-delete pattern — stale
counts are rejected server-side). Copy no longer claims suggestions repopulate:
it says plainly the heads' training examples are deleted and re-tagging starts
fresh. Moved out of TagMaintenanceCard into DangerZoneCard.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CDgx8bQS5YrGRK76v8HUnM

frontend/src/views/CleanupView.vue

@@ -39,6 +39,17 @@
         <TagMaintenanceCard />
       </div>
     </section>
+
+    <section class="fc-section fc-danger">
+      <h3 class="fc-section__title fc-danger__title">Danger zone</h3>
+      <p class="fc-section__hint">
+        Whole-instance resets. Each needs a fresh preview and a typed
+        confirmation code.
+      </p>
+      <div class="fc-tile-grid">
+        <DangerZoneCard />
+      </div>
+    </section>
   </div>
 </template>
 
@@ -50,6 +61,7 @@ import PostMaintenanceCard from '../components/settings/PostMaintenanceCard.vue'
 import VideoDedupCard from '../components/settings/VideoDedupCard.vue'
 import GatedPurgeCard from '../components/settings/GatedPurgeCard.vue'
 import TagMaintenanceCard from '../components/settings/TagMaintenanceCard.vue'
+import DangerZoneCard from '../components/settings/DangerZoneCard.vue'
 </script>
 
 <style scoped>
@@ -75,4 +87,12 @@ import TagMaintenanceCard from '../components/settings/TagMaintenanceCard.vue'
   gap: 14px;
   align-items: start;
 }
+/* Danger zone: visually fenced off from routine cleanup so the reset can't
+   be mistaken for maintenance. */
+.fc-danger {
+  border-top: 1px solid rgba(var(--v-theme-error), 0.45);
+  padding-top: 18px;
+  margin-top: 36px;
+}
+.fc-danger__title { color: rgb(var(--v-theme-error)); }
 </style>