fix(files): correct quota stream accounting

[joshtrichards]

• Resolves: #

Summary

Correct stream quota accounting and add regression coverage for short reads, short writes, and failed seeks.

Problem:

The quota stream tracks a mutable allowance for each wrapped stream. Several edge cases could make that allowance diverge from the actual stream state:

• stream_read() reduced the allowance by the requested byte count, even when the underlying stream returned fewer bytes at EOF. This could consume allowance for bytes that were not actually read.
• stream_seek() adjusted the allowance before knowing whether the underlying seek succeeded. A failed seek could therefore change quota accounting.
• Seeking beyond the quota could make the allowance negative. That value was then passed as the length to substr(), where PHP interprets it as a negative length rather than as zero available bytes.
• Before fix(files): decrement quota by actual bytes written in stream_write #55731, stream_write() reduced the allowance by the intended write size instead of the number of bytes actually written.

Changes:

• Decrement the allowance by the number of bytes actually read.
• Decrement the allowance by the number of bytes actually written.
• Update the allowance only after a seek succeeds.
• Restore the original stream position on failed seeks on a best-effort basis, without changing the allowance.
• Explicitly reject writes when the remaining allowance is non-positive, preventing negative allowances from being interpreted as negative substr() lengths.
• Document the allowance as an int|float byte count.
• Add regression tests for:
  • short writes from the underlying stream;
  • short reads at EOF;
  • failed SEEK_SET and SEEK_END operations;
  • writes after seeking beyond the quota.

The short-write regression test also covers the behavior fixed by #55731.

TODO

• Backport?

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

• The content of this PR was partly or fully generated using AI