docs(cloud): document governance rollout

docs/CLOUD_DEPLOYMENT.md

@@ -229,7 +229,9 @@ The repository ships an independent Vue 3 + Vite SPA at `cloud-console/` that
 renders task history, devices, hosts, and plugins. Human operators sign in with
 a username and password; the Cloud API creates an expiring, revocable
 `HttpOnly` session cookie and uses a separate CSRF cookie/header for writes.
-The Console has no bearer-token fallback or user-directory view.
+An administrator can manage accounts, submission policies, Host operational
+limits, and non-secret Cloud-proxy token usage from **Users & limits**. Bearer
+tokens remain a compatibility path for API/SDK automation.
 
 ### HTTPS and session configuration
 
@@ -396,6 +398,34 @@ mode:
 `AI_PLANNER_TRANSPORT` unset or `direct` preserves the existing
 direct-to-provider behavior with no change.
 
+### Host governance and Cloud-proxy token budgets
+
+After deploying the API migration, an administrator can use **Users & limits**
+in `/console/` to restrict a user's task submission to explicit Host/Device
+targets, enable or disable Host self-submission, and set a Host active-task
+limit. Policies are enforced by the API and scheduler; hiding Console controls
+is not an authorization boundary.
+
+Cloud-enforced token budgets require `AI_PLANNER_TRANSPORT=cloud`. Before each
+proxy decision, the API atomically reserves
+`CLOUD_PLANNER_TOKEN_RESERVATION_CEILING` tokens (default `4096`) for the
+current UTC day. Set `CLOUD_PLANNER_TOKEN_RESERVATION_TTL_SECONDS` (default
+`300`) to bound an unknown-usage reservation after provider/transport failure.
+The daily Host budget must accommodate the reservation ceiling; otherwise the
+proxy rejects before calling the provider. On a provider response, the
+reservation is settled to reported usage and the Console retains only timestamp,
+provider/model, token counts, and optional task/attempt identifiers.
+
+Hosts reporting `AI_PLANNER_TRANSPORT=direct` are explicitly shown as
+**unmetered**. Cloud cannot enforce or verify their provider token use. Do not
+interpret an unmetered Host's absence of usage events as budget compliance.
+
+Roll out in this order: migrate the Cloud database, deploy the Cloud API,
+switch a pilot Host to Cloud transport, configure a budget above the reservation
+ceiling, then review its usage events before enabling budgets fleet-wide. A
+rollback to direct transport requires valid provider credentials on that Host;
+preserve usage and policy rows rather than deleting accounting history.
+
 ## Operational Limitations
 
 Run exactly one scheduler-enabled Cloud API process. SQLite supports only the