feat(worker): clamp max-turns to a configurable ceiling

Runaway sessions were the single biggest cost driver: model_presets was
never persisted (stayed code-only), default_max_turns shipped at 100, and
ResolveMaxTurns had no upper bound, so a task/list override could run
hundreds of turns unchecked.

- TaskRunner.ResolveMaxTurns now clamps the resolved value to
  AppSettings.MaxTurnsCeiling (new column, default 80) and logs a warning
  with task id / requested / effective value when it clamps.
- default_max_turns default lowered from 100 to 40 (entity, EF config,
  and the seeded row via the new AddMaxTurnsCeiling migration).
- AppSettingsRepository.GetAsync backfills model_presets with the
  shipping defaults on first read instead of leaving the column null.
- Settings > General's per-model preset table and the task/list agent
  editor now show a hint when a set max-turns value exceeds the ceiling.

src/ClaudeDo.Data/Configuration/AppSettingsEntityConfiguration.cs

@@ -18,10 +18,13 @@ public class AppSettingsEntityConfiguration : IEntityTypeConfiguration<AppSettin
         builder.Property(s => s.DefaultModel)
             .HasColumnName("default_model").IsRequired().HasDefaultValue("sonnet");
         builder.Property(s => s.DefaultMaxTurns)
-            .HasColumnName("default_max_turns").IsRequired().HasDefaultValue(30);
+            .HasColumnName("default_max_turns").IsRequired().HasDefaultValue(40);
         builder.Property(s => s.DefaultPermissionMode)
             .HasColumnName("default_permission_mode").IsRequired().HasDefaultValue("bypassPermissions");
 
+        builder.Property(s => s.MaxTurnsCeiling)
+            .HasColumnName("max_turns_ceiling").IsRequired().HasDefaultValue(80);
+
         builder.Property(s => s.MaxParallelExecutions)
             .HasColumnName("max_parallel_executions").IsRequired().HasDefaultValue(1);