Engine: per-graph memory budget and per-query memory limit, refuse with resource_exhausted (EN-9) #262

Goal. A per-graph memory budget and a per-query memory limit: a query or write that would exceed them is refused with resource_exhausted, instead of growing the process.

Why. An inputlayer-server grew to about 115 GiB on a development host and took the machine down. In production one query must never take down its process or its neighbours, and the process must stay inside its container limit.

Done when. Budgets are configurable per graph and per query; evaluation checks them and refuses cleanly; the server stays under its configured limit in a stress test with runaway joins; metrics expose usage per graph.

Plan reference: EN-9. Production safety, priority. Part of the Engine production readiness milestone (the current focus; tracker #199). Rule for every engine PR: millisecond query and update latency must not regress, and the perf gate runs before the PR opens.