fix: preserve assistant CSS and daily quota history (#6705)

* fix: route custom css through review form

* feat(workshop): retain daily assistant quotas

apps/docs/docs/workshop/homarr-provider.mdx

@@ -38,8 +38,10 @@ its server; changing the browser clock cannot bypass them.
 Workshop keeps the OpenRouter API key on its server. Homarr and the browser never receive it.
 
 Prompts, attachments, tools, and tool results pass through Workshop and OpenRouter. Workshop does not retain this
-content or the responses. It stores only the user, UTC day, and counters needed to enforce allowances. OpenRouter is
-configured for zero data retention with data collection disabled. Homarr does not use this content to train models.
+content or the responses. It stores only the user, UTC day, and counters needed to enforce allowances. Each active day
+has a separate quota record so Workshop operators can inspect per-user daily usage without seeing request content.
+OpenRouter is configured for zero data retention with data collection disabled. Homarr does not use this content to
+train models.
 
 We would rather become millionaires in a more ethical manner.
 

apps/docs/docs/workshop/operator.mdx

@@ -72,6 +72,9 @@ per-request telemetry. It accepts only uploaded image data, conservatively bound
 allows at most two concurrent requests per user and 100 across the service. Keep an OpenRouter account-level credit
 limit as the final monetary backstop because request quotas are not dollar accounting.
 
+PocketBase stores one `assistant_quotas` record per user and active UTC day. Workshop superusers can use this private
+collection for a daily usage breakdown; regular users cannot list or view its records.
+
 Run `pnpm test:workshop` to test authentication, streaming, UTC reset, atomic per-user and global quota enforcement,
 failed-request accounting, identity attribution, server-selected model routing, function tools, input and output
 controls, privacy routing, spoofing resistance, absence of request logs, and migration rollback.