Corregge il provisioning Hetzner: Faraday, cloud-init e default cpx12.

Sistemati path API /v1, AppArmor/auth MediaMTX sul nodo e defaults nbg1 così lo smoke Cloud è ripetibile.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/spec/services/streams/autoscaler_spec.rb

@@ -17,6 +17,8 @@ RSpec.describe Streams::Autoscaler do
     redis.del(Streams::Autoscaler::LOCK_KEY)
     redis.del(Streams::Autoscaler::KILL_SWITCH_KEY)
     redis.del(Streams::DnsProviders::Lab::REDIS_KEY)
+    StreamSession.where.not(stream_node_id: nil).update_all(stream_node_id: nil, status: "ended", ended_at: Time.current)
+    StreamNode.where.not(slug: Streams::NodeRegistry::HOME_SLUG).delete_all
   end
 
   it "is a no-op when disabled" do
@@ -153,7 +155,10 @@ RSpec.describe Streams::Autoscaler do
       "MEDIAMTX_RTMP_URL" => "rtmp://home.example:1935",
       "HLS_PUBLIC_URL" => "https://home.example/hls"
     ) do
+      StreamSession.where.not(stream_node_id: nil).update_all(stream_node_id: nil, status: "ended", ended_at: Time.current)
+      StreamNode.where.not(slug: Streams::NodeRegistry::HOME_SLUG).delete_all
       home = Streams::NodeRegistry.ensure_home_from_env!
+      home.update!(max_publishers: 1)
       user = User.create!(email: "budget@example.com", name: "B", password: "Password123", role: "coach")
       club = Club.create!(name: "Budget", sport: "volleyball")
       team = club.teams.create!(name: "T", sport: "volleyball", slug: "budget-t")
@@ -165,7 +170,9 @@ RSpec.describe Streams::Autoscaler do
 
       result = described_class.reconcile!(provisioner: provisioner)
       expect(result.actions).to include(:blocked_capacity)
-      expect(described_class.metrics[:within_budget]).to eq(true)
+      # 0 overflow nodes → stima 0€ ≤ budget; il blocco è sul nodo successivo (+1)
+      expect(described_class.within_budget?(0)).to eq(true)
+      expect(described_class.within_budget?(1)).to eq(false)
     end
   end
 end