feat: make model quota sources explicit and safe

[lcEverflow]

Summary

• make Claude/Codex quota collection explicit opt-in, require a write-only OAuth access token, and let users select Claude quota families or Codex metered_feature buckets
• default to manual, source-scoped refresh; coalesce duplicate requests, preserve last-good data, and stop task completion from refreshing every provider
• add matching native/Web configuration, honest stale/error states, masked API payloads, and dynamic task model/effort metadata
• harden config/state persistence, HTTP/token/transcript security, scheduler/quota/tunnel/Chrome lifecycle races, crash recovery, log retention, and shutdown rollback
• harden LaunchAgent install/restart/uninstall and DMG validation, bump to 0.10.4, and add macOS/Linux CI

Security and migration

• removes hidden Claude Keychain / CLI-auth discovery for subscription quota
• credentials are write-only and never returned by state, provider config, menu debug, or logs
• legacy browser tokens/caches and insecure permissions are migrated; old admin tokens rotate only when the replacement service actually starts
• LAN access now defaults off and credential routes require a direct trusted loopback request

Verification

• local full suite: uv run pytest -q -o addopts= — 343 passed
• GitHub Actions — green: Ubuntu/Python 3.11 core suite and macOS 26/Python 3.13 full suite
• git diff --check, uv lock --check, compileall, Shell syntax, embedded JavaScript parse, and Ruff critical checks passed
• wheel 0.10.4 built and contains both Web resources
• full DMG build passed bundle smoke, codesign verification, and hdiutil verify
• tunnel startup/exit race regression repeated 100/100 successfully

Known release follow-up

The DMG remains build-machine architecture and ad-hoc signed. Developer ID signing and Apple notarization are still required for polished external distribution.