feat(providers): derive + surface expiry for JWT-bearing web cookies (#11497)

[oyi77]

Closes #11497.

What

Web-cookie rows had no expiry signal even when the pasted credential embeds a standard JWT with an exp claim (ChatGPT __Secure-next-auth.session-token, Qwen/Z.ai localStorage tokens). Operators got their first indication of expiry from a live request failing.

• New pure util src/shared/utils/webCookieExpiry.ts:
  • decodeJwtPayloadExp — strict JWT-shaped decode (3 dot segments, base64url, JSON-object payload, positive numeric exp), size-capped;
  • deriveCookieExpiryIso — scans the whole credential then each cookie-pair value;
  • withDerivedCookieExpiry — merge helper that RECOMPUTES on every save: re-pasting refreshes the date, an opaque replacement cookie drops the stale date instead of leaving a lie on the row.
• Persistence at the existing chokepoint: normalizeConnectionProviderSpecificData in src/lib/db/providers.ts (same place the Codex fingerprint seed is applied) — covers create/edit/import/health-stamp writes for catalogued WEB_COOKIE_PROVIDERS only.
• Dashboard: ConnectionRow and the Limits-page QuotaCardHeader feed providerSpecificData.cookieExpiresAt into the existing token-expiry countdown badges. Opaque cookies (claude sessionKey, grok sso) stay undated — no false precision.

No network calls, no schema migration (providerSpecificData is free-form JSON).

Verification

• New unit suite tests/unit/web-cookie-expiry.test.ts: 9/9 pass — valid decode, url-safe/unpadded base64, cookie-header pair scan, opaque → null, malformed/non-positive/array/primitive payloads, reader guards, set/preserve-siblings, stale-drop-on-opaque-replacement, no-credential passthrough.
• Save-path regression: db-provider-cookie-dedup-3368 + db-provider-limits suites 17/17 combined pass after the chokepoint change.
• npx tsc --noEmit -p tsconfig.json: zero diagnostics in the five touched files.
• ESLint: new files clean; the 4 unused-import errors in src/lib/db/providers.ts are byte-identical on the pristine base commit (verified via stash diff) and untouched here.
• npm run check:file-size: OK.

Changed files

• src/shared/utils/webCookieExpiry.ts (new)
• src/lib/db/providers.ts (+40 wiring lines at the normalization chokepoint)
• src/app/(dashboard)/dashboard/providers/[id]/components/ConnectionRow.tsx (+8)
• src/app/(dashboard)/dashboard/usage/components/ProviderLimits/parts/QuotaCardHeader.tsx (+4)
• tests/unit/web-cookie-expiry.test.ts (new)

[oyi77]

CI triage for the current red batch (Docs Gates / unit shards / Vitest / ESLint-suppressions): reproduced at today's merge ref (a179ffed5 + this branch) with none of this branch's content — check:docs-counts fails STRICT on README/AGENTS/llm.txt still saying "159 migrations" while code has 160, and tests/unit/agent-card-route.test.ts + tests/unit/providers-constants-split.test.ts fail at the tip itself. Inherited tip-drift, not introduced here.

This branch's own receipts stay green: web-cookie-expiry.test.ts 9/9, save-path regressions (db-provider-cookie-dedup-3368, db-provider-limits) 17/17 combined, tsc clean on touched files.