fix(backend-quota): strip the currency string and bound the balance read

The balance reply comes from whatever host `account.upstream` names. Its
`currency` field reached the operator's terminal verbatim through
`teamclaude status` whenever it was not USD/CNY — a window-title rewrite, a
screen clear or a `\r` overprint forging a plausible quota line was one JSON
field away — and the body was buffered whole with no size cap, so a hostile
or broken backend could make the proxy hold an arbitrary response on every
probe cycle.

Strip and bound the currency with safeLine, like every other externally
sourced string status-renderer prints, and read the body through a 64 KiB
cap (declared or actual) before parsing, the same bound server.js applies to
a diagnostic error body.

Closes #310.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>