fix(codex): recover reset cooldowns and expose account release

[JxnLexn]

After redeeming a Codex reset credit, fresh quota can show available headroom while the account remains excluded by a persisted scoped cooldown. Hydrate scoped quota observations from live usage and release the unchanged cooldown when both governing windows have available quota. A compare-before-write guard retains failures recorded while the usage request was in flight.

Add an authenticated per-account action to clear the local Codex cooldown without redeeming a credit or changing credentials. Populate the account quota card from persisted usage-cache observations as well as response headers, and remove the obsolete Spark card from this view.

Validation:

• 21 focused Node tests passed on the release branch, including reset-credit flow, scoped recovery, concurrent cooldown preservation, management auth and quota projections.
• 3 React UI tests passed (release success/failure, account targeting and no Spark card).
• Core typecheck and focused ESLint passed.
• Fork Vitest suite: 405 tests passed. Full Node suite is not green; unrelated failures and a local dependency switch affected the broad run. No full-suite success is claimed.

⚠️ base-red inherited: #13866

Release CI currently also reports unrelated baseline drift in omni-version-manager generated skills and environment documentation (BRIDGE_PORT, CERT_DIR, NEXT_PUBLIC_PORT, OPENWA_SERVICE_PORT, ROUTER_URL), plus TS2677 in rerankProviderNodes.ts and antigravity.ts. These files are unchanged by this PR. The introduced provider-route cache-index type error was corrected; focused provider-route tests pass again.

Fork deployment validation (LeonAPI, combined revision a84cee19862d7c06eb77c6660e0050204a868d5e): image build succeeded; container healthy with zero restarts. Authenticated GET /api/providers?provider=codex now returns available quota-window observations (all ten accounts previously had null windows). Unauthenticated manual-release POST returns 401, authenticated missing-account POST returns 404. A real POST /v1/responses through gpt-5.6-luna-combo returned HTTP 200 and OK. No reset credit was consumed for validation. DB backup passed quick_check and foreign_key_check.

[diegosouzapw]

Thanks @JxnLexn — merging via the release merge-train. Validated in local merge-train (mt-train10c) on the devbox @ train tip 4d841aa1c740bbaa03868dc0a403c62099a99a42 with the 72 sibling PRs of this batch: typecheck:core, file-size, complexity, cognitive-complexity, changelog-integrity green; changed-area node:test 831/831 (0 failing) and vitest 480/482 — the two reds are autoCombo/provider-family-combos.test.ts timing out at 20s, which reproduces on the PURE release tip under the full vitest suite (and is already tracked by the Release-Green issue #13866), so it is inherited, not this batch's. Merged --admin per merge-gates §3/§4/§7.