fix(cli): show Codex OAuth quota in status bar

[baileyh8]

What does this PR do?

Adds an opt-in OpenAI Codex OAuth quota readout to the classic CLI status bar. It shows only the windows returned by the usage API, as remaining percentages:

week 69%
5h 82% | week 69%

The usage request runs in a daemon worker and never blocks prompt-toolkit rendering. Results are cached for five minutes, refresh failures fail open and hide stale values, and the cache is isolated by a non-reversible credential identity plus generation guard so an old account request cannot overwrite a newly rotated credential.

The fix also recognizes the current API shape where a single seven-day window is returned as primary_window; that window is labeled Weekly rather than Session.

Related Issue

No existing issue found.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• Classify 6–8 day Codex quota windows as Weekly even when returned as primary_window.
• Add a non-blocking, credential-scoped account-usage cache to the classic CLI status bar.
• Render 5h N% and/or week N%; omit unavailable windows.
• Add display.account_usage_footer.enabled and refresh_seconds defaults and examples.
• Document the setting in English and Simplified Chinese.
• Cover weekly-only responses, both windows, caching, fail-open behavior, credential rotation races, and stale-value removal.

How to Test

1. Authenticate with hermes auth using OpenAI Codex OAuth.

2. Add this to ~/.hermes/config.yaml:

   display:
     account_usage_footer:
       enabled: true
       refresh_seconds: 300

3. Start classic CLI with an OpenAI Codex model. The status bar should show week N%; when the API also returns the five-hour window it should show 5h N% | week N%.

4. Run:

   scripts/run_tests.sh tests/agent/test_account_usage.py tests/test_account_usage.py tests/cli/test_cli_status_bar.py tests/hermes_cli/test_config.py tests/test_lint_config.py -q

Verification on macOS 26.5.1:

• Focused suite: 229 passed, 0 failed.
• Real OAuth E2E: week 69%, 5h None; rendered week 69% only.
• Windows footgun scan: passed.
• Full repository suite: 41,958 passed; 29 failures in 17 unrelated files and 3 unrelated browser/provider files timed out. No changed-file test failed; representative Anthropic failures reproduce alone on current main code.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix
• I've run the full test suite and all tests pass (see unrelated current-main failures above)
• I've added tests for my changes
• I've tested on macOS 26.5.1

Documentation & Housekeeping

• I've updated relevant documentation
• I've updated cli-config.yaml.example
• Architecture/workflow docs: N/A
• I've considered cross-platform impact; the worker uses existing Python threading and no platform-specific APIs
• Tool descriptions/schemas: N/A

Screenshots / Logs

⚕ gpt-5.6-luna │ 0/272K │ 0% │ week 69% │ 15m │ ⏲ 0s

[alt-glitch]

This was generated by AI during triage.

Related: #19063 and #34828 also implement Codex quota status-bar visibility. This PR uses the existing account-usage path with an opt-in footer; maintainers should select the desired UX and quota-fetching implementation.