[alexeybe1kin]

Hunt findings memorygate-2 F50 and F19.

• PUT /config/{agent} accepted any max_observations and any threshold. With a cap of 0 or less and no unconfirmed observation, enforce_budget called max() on an empty list, so every observation create answered 500.
  • The request now takes max_observations 1..100000 and the thresholds 0..1, and answers 422 outside those ranges.
  • A cap below one that is already stored counts as one.
• Lowering the cap archived only one observation per create, so the count never came back under the cap. Now one call archives enough of the most-exposed unconfirmed observations to leave room for the new one.
• The archive now runs inside the create's own transaction (flush, not commit), so it is committed with the new observation or not at all.

Tests: four new cases in tests/test_observation_budget.py, all failing on main. Locally: budget, observation and config tests 30 passed; ruff, types and sizes ok.