Neon Free-plan quota monitoring, alerts, and upgrade runbook

[pataniaeli]

Ticket: AUTH-T101 · Epic: E1 Foundation & Neon Migration · Phase: Phase 0 — Foundation
Priority: High · Estimate: 2 points · Labels: epic:foundation, phase:0, infra, neon, observability

Depends on:

• Provision the Neon project, branches, and roles for SGAuth #12 — AUTH-T01 Provision the Neon project, branches, and roles for SGAuth

Accepted risk from the red-team review: SGAuth runs on Neon Free, which suspends the compute for the remainder of the month once the project uses 100 CU-hours. A compute that stays awake most of the day at the 0.25 CU minimum uses about 180 CU-hours/month, so exhaustion is plausible once several products are live, and it would take every SGA login down at once.
Mitigations: (1) a scheduled job (AUTH-T38, daily) reads consumption via the Neon API and emails all admins at 50%, 70%, and 85% of the monthly CU-hour quota, with a projection of the exhaustion date; (2) keep scale-to-zero at 5 minutes and rely on the SDK cache so idle periods suspend the compute; (3) docs/runbooks/neon-upgrade.md: one-click upgrade to Launch (pay-as-you-go, $0.106/CU-hour), what changes (7-day restore window, scale-to-zero configurable), and who is authorized to approve the spend; (4) record the 6-hour restore window as a known limitation in the architecture doc; (5) never add keep-warm pings (they burn the quota).

Acceptance criteria

• Alert emails fire at the thresholds (tested by lowering the threshold on dev).
• Runbook merged and the upgrade trigger (85% or any suspension) is written into the on-call notes.
• ARCHITECTURE.md states the Free-plan risk and the restore window explicitly.

_{Generated from the SGAuth design (docs/sgauth-design in SGAOperations/auth). SGAuth is built on Neon and does not use Supabase.}