fix: scale replicas in response, K8s metrics client, quota precheck, auth tests

- Add GetMetrics method to MetricsClient interface and implement cluster metrics API
- Add QuotaPrecheck service for validating resource quotas before deployment
- Add auth DTO with role/permission models and auth handler tests
- Add instance diagnostics: mounted NFS volumes, labels, annotations in pod diagnostics
- Update workspace handler with GetWorkspace endpoint and shared-user list
- Fix monitoring handler to use correct service method name
- Add tail_lines fallback in instance handler for snake_case query params
- Update nginx config for SSE log streaming support (no buffering)
- Add comprehensive test coverage: auth_service_test, auth_handler_test,
  auth_dto_test, metrics_client_test, quota_precheck_test
- Update error messages for quota validation and instance operations
- ModifyModal: fix YAML lineWidth:0, modified keys summary, delta-only submit
- InstanceCard: correctly disable scale-minus when replicas <= 0
- SidebarLayout: add hover transition for sidebar items
- Update todo.md and lessons.md with latest fixes

backend/internal/adapter/output/persistence/mock/workspace_repository_mock.go

@@ -72,6 +72,16 @@ func (r *WorkspaceRepositoryMock) Update(ctx context.Context, workspace *entity.
 	return nil
 }
 
+func (r *WorkspaceRepositoryMock) Delete(ctx context.Context, id string) error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if _, ok := r.workspaces[id]; !ok {
+		return entity.ErrWorkspaceNotFound
+	}
+	delete(r.workspaces, id)
+	return nil
+}
+
 func (r *WorkspaceRepositoryMock) List(ctx context.Context) ([]*entity.Workspace, error) {
 	r.mu.RLock()
 	defer r.mu.RUnlock()
@@ -118,6 +128,20 @@ func (r *WorkspaceClusterBindingRepositoryMock) Get(ctx context.Context, workspa
 	return &copy, nil
 }
 
+func (r *WorkspaceClusterBindingRepositoryMock) ListByWorkspace(ctx context.Context, workspaceID string) ([]*entity.WorkspaceClusterBinding, error) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	result := make([]*entity.WorkspaceClusterBinding, 0)
+	for _, binding := range r.bindings {
+		if binding.WorkspaceID != workspaceID {
+			continue
+		}
+		copy := *binding
+		result = append(result, &copy)
+	}
+	return result, nil
+}
+
 func (r *WorkspaceClusterBindingRepositoryMock) Delete(ctx context.Context, workspaceID, clusterID string) error {
 	r.mu.Lock()
 	defer r.mu.Unlock()