feat: auto-detect CLI quota sources (v0.10.5)

[lcEverflow]

Summary

• remove manual Claude/Codex OAuth token and account-id fields from native/Web/API/config
• detect Claude Code login status via claude auth status --json without reading Keychain or credential files
• read Codex ChatGPT subscription windows through a bounded, short-lived codex app-server session, with runtime capability fallback
• add discovered Codex limitId choices, source-scoped/coalesced refresh, and config schema v3 secret cleanup
• harden DMG artifact publishing and bump AgentBar to 0.10.5

Safety and compatibility

• Claude subscription percentages are not fabricated: AgentBar shows observed limit events and optional ccusage only
• Codex App Server is treated as experimental; unsupported/old CLIs degrade to unknown/observed
• API rejects legacy quota secret fields and never returns CLI credentials or account PII
• automatic polling remains opt-in; default refresh mode is manual

Verification

• uv run pytest -o addopts= -q — 353 passed
• real local Claude/Codex smoke — login status and Codex rate-limit windows parsed with whitelisted output only
• App Server timeout/output/server-request/process-group regression coverage and no residual process in real smoke
• uv lock --check, compileall, git diff --check, shell syntax, embedded Web JS parse, Ruff selected fatal rules
• wheel and sdist build successfully