fix(claude): prefer limits[] session over stale five_hour after 5h rollover

[Finesssee]

Summary

Fixes #279.

After a session (5h) window resets, the legacy five_hour.utilization field can transiently report 1.0 (normalized to 100%) for the new window, even though claude.ai shows only 5%. This is the same bug class as #210, which was fixed for the weekly/all-models lane in 0.48.0 by preferring the limits[] weekly_all entry over legacy seven_day.utilization.

This PR applies the identical pattern to the session (5h) lane, in both the OAuth and web API paths.

Root cause

Right after a window rollover, Anthropic leaves the legacy five_hour.utilization field stale (reporting 1.0 → 100%) while the limits[] array already carries the fresh value as an entry with kind == "session", group == "session". The legacy field was read directly, so the stale 100% won transiently until the legacy field caught up.

Fix

• scoped_weekly.rs: add session_window(limits) — reads the 5h session window from the limits[] array (kind == "session", group == "session"), mirroring weekly_all_window.
• web_api.rs: the primary lane now prefers session_window(&usage.limits) over legacy five_hour, falling back to the legacy field, then the informational 5h placeholder.
• oauth/mod.rs: the primary lane now prefers session_window(&response.limits) over legacy five_hour, falling back to the legacy field, then 0%.

Provider-specific logic stays inside rust/src/providers/claude/ (no cross-provider branching). No secrets/tokens are logged.

Backwards compatible

When no limits[] session entry is present (older API shape), the legacy five_hour field is still the source of truth — verified by a dedicated fallback test in each path.

Test plan

• cargo test --manifest-path rust/Cargo.toml — 1220 passed, 0 failed
• cargo clippy --manifest-path rust/Cargo.toml --all-targets -- -D warnings — clean
• cargo fmt --all -- --check — clean
• New unit tests reproduce the transient-100% scenario and assert the limits[] value (5%) wins over the stale legacy field (100%):
  • scoped_weekly::tests::session_window_prefers_limits_percent_over_stale_five_hour
  • scoped_weekly::tests::session_window_ignores_mismatched_group_and_null_percent
  • web_api::tests::issue_279_session_limits_win_over_stale_five_hour_after_rollover
  • web_api::tests::session_falls_back_to_legacy_five_hour_without_limits_entry
  • oauth::tests::issue_279_session_limits_win_over_stale_five_hour_after_rollover
  • oauth::tests::session_falls_back_to_legacy_five_hour_without_limits_entry

No UI/tray/float-bar behavior changed; no CUA proof needed (backend parser fix only).

Fixes #279.