[KiaroSama]

Summary

An OAuth re-import or connection update replaces providerSpecificData. When the incoming metadata omits the operator's Codex quota preferences, that replacement drops the opt-out and enables the quota preflight again. Requests then stop at exhausted subscription quota before the upstream can decide whether account credits are usable.

Preserve only existing limitPolicy and quotaPreflightEnabled keys that incoming Codex metadata omits. Explicit incoming values, including null, remain authoritative. Fingerprint normalization and cookie-expiry behavior stay unchanged in the extracted helper.

Codex metadata omits preference -> retain existing preference
Codex metadata provides preference -> use incoming value

Evidence

• Real isolated SQLite regression covers OAuth deduplication/re-import, ordinary updates, fingerprint retention, explicit re-enabling and explicit metadata reset. Existing cached/live quota and terminal-account controls remain.
• The same fix passed hosted validation on the preserved image baseline: run 38261925827, 259 tests in 42 suites, static compiler checks, backend build and full Windows packaging. This PR adapts only the three quota files to release/v3.8.52; the image history is excluded.
• Formatting, suppression-aware ESLint, identity, tracked-artifact, documentation-sync and explicit-any checks passed for this branch. Upstream exact-PR checks are pending; inherited release-base failures are tracked separately in fix: repair guarded transport and release CI contracts #16420.

Merge Danger

Two-way door: revert this commit to restore replacement behavior; no schema migration or credential rotation.

Blast radius: only omitted operator preferences on existing Codex metadata. Other providers, explicit settings changes and terminal account guards retain their behavior. This does not create upstream credit entitlement or bypass upstream billing decisions.