whoami and get_total_storage show app usage against the account-wide storage limit #236

What happens

The MCP whoami and get_total_storage tools (and REST getTotalSpaceOccupied) report storage for the current app only, but maxStorage is the account-wide limit. Upload validation checks usage across all apps on the account.

So an agent can see plenty of room and still get refused.

Repro (Oct 30, 2026)

1. Over MCP (OAuth, app "Grok", not the default app), whoami returned storage: 1138868 (~1.1 MB) and maxStorage: 1073741824 (1 GB). get_total_storage returned the same.
2. create_upload_signature, then a 5 MB POST /media/create with x-medialit-signature got 403 "Not enough storage space in your account to upload this file". A 12-byte and a 900 KB file uploaded fine.
3. After files were cleared from another app on the same account, the same 5 MB upload succeeded.

Why

• apps/api/src/media/storage-middleware.ts hasEnoughStorage() calls getTotalSpace({ userId }), which is account-wide.
• apps/api/src/mcp/tools/whoami.ts:44, apps/api/src/mcp/tools/media.ts:272 and apps/api/src/media/handlers.ts:111 call getTotalSpace({ userId, appId }), which is app-only, and pair it with the account limit.

Suggested fix

Report account-wide usage next to maxStorage (for example accountStorage), and keep the app's usage as a separate field, so agents can tell how much room is really left before uploading.