fix: scale replicas in response, K8s metrics client, quota precheck, auth tests

- Add GetMetrics method to MetricsClient interface and implement cluster metrics API
- Add QuotaPrecheck service for validating resource quotas before deployment
- Add auth DTO with role/permission models and auth handler tests
- Add instance diagnostics: mounted NFS volumes, labels, annotations in pod diagnostics
- Update workspace handler with GetWorkspace endpoint and shared-user list
- Fix monitoring handler to use correct service method name
- Add tail_lines fallback in instance handler for snake_case query params
- Update nginx config for SSE log streaming support (no buffering)
- Add comprehensive test coverage: auth_service_test, auth_handler_test,
  auth_dto_test, metrics_client_test, quota_precheck_test
- Update error messages for quota validation and instance operations
- ModifyModal: fix YAML lineWidth:0, modified keys summary, delta-only submit
- InstanceCard: correctly disable scale-minus when replicas <= 0
- SidebarLayout: add hover transition for sidebar items
- Update todo.md and lessons.md with latest fixes

backend/internal/adapter/input/http/dto/auth_dto_test.go

@@ -0,0 +1,51 @@
+package dto
+
+import "testing"
+
+func TestRegisterRequestNormalizeUsesSnakeCaseAlternates(t *testing.T) {
+	active := false
+	mustChange := true
+	req := RegisterRequest{
+		WorkspaceIDSnake:        "workspace-1",
+		DefaultClusterIDSnake:   "cluster-1",
+		QuotaCPUSnake:           "2",
+		QuotaMemorySnake:        "4Gi",
+		QuotaGPUSnake:           "1",
+		QuotaGPUMemSnake:        "10000",
+		IsActiveSnake:           &active,
+		MustChangePasswordSnake: &mustChange,
+	}
+
+	req.Normalize()
+
+	if req.WorkspaceID != "workspace-1" || req.DefaultClusterID != "cluster-1" {
+		t.Fatalf("expected snake case workspace/cluster fields to normalize, got %#v", req)
+	}
+	if req.QuotaCPU != "2" || req.QuotaMemory != "4Gi" || req.QuotaGPU != "1" || req.QuotaGPUMem != "10000" {
+		t.Fatalf("expected snake case quota fields to normalize, got %#v", req)
+	}
+	if req.IsActive == nil || *req.IsActive {
+		t.Fatalf("expected is_active=false to normalize, got %#v", req.IsActive)
+	}
+	if req.MustChangePassword == nil || !*req.MustChangePassword {
+		t.Fatalf("expected must_change_password=true to normalize, got %#v", req.MustChangePassword)
+	}
+}
+
+func TestUpdateUserRequestNormalizeKeepsCamelCasePrimary(t *testing.T) {
+	req := UpdateUserRequest{
+		DefaultClusterID:      "camel-cluster",
+		DefaultClusterIDSnake: "snake-cluster",
+		QuotaCPU:              "3",
+		QuotaCPUSnake:         "4",
+	}
+
+	req.Normalize()
+
+	if req.DefaultClusterID != "camel-cluster" {
+		t.Fatalf("expected camelCase defaultClusterId to win, got %q", req.DefaultClusterID)
+	}
+	if req.QuotaCPU != "3" {
+		t.Fatalf("expected camelCase quotaCpu to win, got %q", req.QuotaCPU)
+	}
+}