feat(desktop): official quota chip on the status bar

[lorencato23]

Summary

Depends on #93282. Review the latest commit after that CLI PR; this one only adds the desktop surface.

• GET /api/account-usage — same official snapshot as hermes usage
• Compact chip on the desktop footer next to This device / Gateway / workspace: Codex 0% · Claude 8%
• Hover shows the windows; click refreshes
• 5-minute cache; fetch happens off the render path; empty/failed payload hides the chip
• No Grok scrape. No TUI/CLI status-bar changes (feat: show Codex session reset in status bar #44506 / feat(cli+tui): provider quota and rate-limit in status bar #53375)

Test plan

• python3 -m pytest tests/hermes_cli/test_usage_cmd.py tests/agent/test_account_usage.py tests/hermes_cli/test_status.py -q (28 passed)
• Unit test for formatQuotaChip
• After feat(cli): show official OAuth quota via hermes usage #93282 is available on a running backend: chip appears for signed-in Codex/Claude/OpenRouter
• With only SuperGrok signed in, chip stays hidden

[Enough1122]

AI code review — automated review for reference, author can ignore or act on any point.

Overall: well-structured feature — clean separation between fetch (agent/account_usage.py), reporting (hermes_cli/usage_cmd.py), the REST surface, and the desktop chip, with tests on both sides. Points to consider:

1. agent/account_usage.py:~945-952 (compact_account_usage_line) — the reset rendering does string surgery on another formatter's output: _format_reset(window.reset_at).split(' (', 1)[0]. If _format_reset ever changes its parenthetical wording (or localizes it), this silently degrades or leaks half-sentences into hermes status. Prefer adding an explicit parameter (e.g. `_format_reset(reset_at, include_local=False)) so the one-line surface requests what it wants instead of parsing prose.

2. hermes_cli/usage_cmd.py:~118-127 (usage_command, aggregate text path) — when *no* official provider reports ok (fresh install, no creds), the only output is the hardcoded "Grok unsupported" line and exit code 0. That reads like Grok is the notable problem when actually nothing is configured. Suggest printing an explicit "(no providers with usable quota credentials)" summary line, and/or including unavailable rows in text mode rather than silently skipping them.

3. apps/desktop/src/app/shell/hooks/use-account-quota-item.tsx:11,17-23 — the chip polls every 5 minutes unconditionally, even while hidden because the payload never yields rows (no creds). Each tick makes the server fan out to up to four upstream quota APIs via account_usage_payload(None). Consider disabling the query until the first payload proves at least one ok provider (`enabled: ... on useQuery) or backing off after repeated empty responses.

4. hermes_cli/web_server.py:15705-15716 — /api/account-usage triggers authenticated upstream fetches with stored OAuth tokens; please confirm it sits behind the same auth middleware/guard as the sibling `/api/* analytics endpoints (it's easy to miss when adding a route at this layer).

Minor: account-usage.ts:60 renders raw reset_at ISO timestamps in the tooltip; a relative-time format would match the CLI's polish.

[lorencato23]

Follow-up — comentários de revisão

Os pontos de revisão foram incorporados no HEAD atual (38db2a923c5c): o chip usa backoff de 30 minutos quando não há quota visível e o tooltip usa reset relativo. O endpoint permanece protegido pelo mesmo gateway da API.

A validação Python compartilhada do recurso passou no PR dependente #93282: 28 testes focados passaram. A suíte desktop completa ainda depende das dependências Node deste checkout.