feat(render): full-screen render page, one-active-render limit, app-wide progress

Concurrent-render ceiling (a user runs 1 render at a time unless granted more):
- Identity: TokenService emits max_renders claim from User.ParallelRenderingCeiling
- Identity: admin POST /v1/users/{id}/render-slots (AdminService.SetRenderSlotsAsync,
  clamped 1..50) — gamification or admin raises a user's ceiling
- render-svc: middleware reads max_renders (default 1); CreateJob rejects with 409
  active_render_limit when active jobs >= ceiling
- render-svc: db.CountActiveJobs + ListActiveJobs; GET /v1/renders/active returns
  in-flight renders + can_start_new

Full-screen render page (replaces the modal):
- /studio/render/[projectId]: config (resolution/fps) → live preview + progress →
  download; resumes this project's in-flight render on mount; blocks when another
  render is active; reads ?preset=
- StudioTopBar export menu now navigates to the page; RenderModal deleted (dead)

App-wide minimal progress:
- GlobalRenderProgress pill mounted in the locale layout for authed users; polls
  /api/render/active every 4s, shows thumbnail + step + % on every page, click →
  the render page; hidden on the render page and when idle

Admin: UserActions gains a "concurrent render slots" control.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

services/identity/FlatRender.IdentitySvc/Application/Services/AdminService.cs

@@ -182,6 +182,19 @@ public class AdminService(IdentityDbContext db)
         await db.SaveChangesAsync();
     }
 
+    /// <summary>
+    /// Set how many renders a user may run concurrently. The render service reads
+    /// this from the JWT (max_renders claim); takes effect on the user's next token
+    /// refresh. Clamped to [1, 50].
+    /// </summary>
+    public async Task SetRenderSlotsAsync(Guid userId, int ceiling)
+    {
+        var u = await RequireUser(userId);
+        u.ParallelRenderingCeiling = Math.Clamp(ceiling, 1, 50);
+        u.UpdatedAt = DateTime.UtcNow;
+        await db.SaveChangesAsync();
+    }
+
     public async Task GrantPlanDaysAsync(Guid userId, Guid planId, int days)
     {
         var plan = await db.UserPlans

services/identity/FlatRender.IdentitySvc/Application/Services/TokenService.cs

@@ -33,6 +33,9 @@ public class TokenService(IConfiguration config) : ITokenService
             new("is_admin", user.IsAdmin.ToString().ToLower()),
             new("is_tenant_admin", user.IsTenantAdmin.ToString().ToLower()),
             new("role", role),
+            // Concurrent-render ceiling — render-svc enforces "active renders < max_renders".
+            // Admin grants or gamification raise ParallelRenderingCeiling; default is 1.
+            new("max_renders", Math.Max(1, user.ParallelRenderingCeiling).ToString()),
         };
 
         if (!string.IsNullOrEmpty(user.Email))

services/identity/FlatRender.IdentitySvc/Controllers/AdminController.cs

@@ -79,6 +79,14 @@ public class AdminController(AdminService svc) : ControllerBase
         return Ok(new { ok = true });
     }
 
+    // Grant a user extra concurrent render slots (takes effect on next token refresh).
+    [HttpPost("v1/users/{userId:guid}/render-slots")]
+    public async Task<IActionResult> RenderSlots(Guid userId, [FromBody] SetRenderSlotsRequest req)
+    {
+        await svc.SetRenderSlotsAsync(userId, req.Ceiling);
+        return Ok(new { ok = true });
+    }
+
     [HttpPost("v1/users/{userId:guid}/grant-plan")]
     public async Task<IActionResult> GrantPlan(Guid userId, [FromBody] GrantPlanDaysRequest req)
     {

services/identity/FlatRender.IdentitySvc/Models/Admin.cs

@@ -37,3 +37,4 @@ public record ResetPasswordRequest(string NewPassword);
 public record AddChargeRequest(int Seconds, int RenderCount);         // grant render seconds / daily renders
 public record GrantPlanDaysRequest(Guid PlanId, int Days);
 public record SetFlagRequest(bool Enabled);
+public record SetRenderSlotsRequest(int Ceiling);            // concurrent-render ceiling