feat(usage): show Kimi Coding Extra Usage

[xz-dev]

Summary

• parse Kimi Code's production GET /coding/v1/usages response into separate Code 5-hour and Code 7-day quota cards
• keep Code 5h, Code 7d, then future windows in a fixed order in both expanded and collapsed Provider Limits views
• show the real Extra Usage wallet state, balance, monthly spend, monthly limit, and official Additional Credits link
• support both kimi-coding OAuth and kimi-coding-apikey connections without adding another upstream request
• preserve the existing Grok billing contract while generalizing Provider Limits billing sanitization and persistence

Production contract

The implementation was verified against the existing read-only Kimi Coding usage endpoint:

• top-level usage is the Code 7-day quota
• a 300-minute limits[] window is the Code 5-hour quota
• each additional limits[] item is preserved under a stable window-derived key
• missing used or remaining values are derived from the reported limit
• the Coding API does not expose the website's shared membership total or Kimi-versus-Code split, so this PR does not synthesize either

The production boosterWallet response can report STATUS_DISABLED with BOOSTER amount fields omitted at an exact zero balance. The parser therefore:

• maps known wallet states to enabled, disabled, frozen, or unavailable
• displays an observed zero balance as zero instead of hiding the wallet
• shows reported monthly spend and monthly charge limit, including zero spend
• rejects sparse unknown-status or allowTopup-only payloads instead of fabricating zero billing

Security / privacy

• fixed official read-only endpoint; no additional network surface
• public billing cache is strict-field sanitized
• no access token, API key, user identity, payment method, raw response, or error body is persisted in the billing contract
• message-only refresh failures retain last-known-good billing

Testing

• focused Kimi, Grok, and fixed-order regression suite: 44/44 passed
• aggregate usage-service hardening suite: 23/23 passed
• focused ESLint on changed TypeScript/TSX files: passed
• Prettier and git diff --check: passed
• changed source files have no dashboard/open-sse TypeScript diagnostics
• dead-code ratchet passes after keeping internal-only Kimi billing types/helpers private
• all new billing keys are present and valid JSON in en, pt-BR, vi, zh-CN, and zh-TW
• independent review: no unresolved findings