Port upstream CodexBar 0.49.0-0.49.2

[Finesssee]

Port of upstream steipete/CodexBar v0.49.0 → v0.49.2 onto the Windows shell (read-only consumption of tagged sources; zero upstream contact per docs/PORTING.md).

Ported

Item	Notes
Fireworks provider (steipete#2687)	Full recipe: rust/src/providers/fireworks/ (30-day rated billing spend from /v1/accounts/<slug>/billing/summary, first-currency row summing, slug charset validation against path/query injection), ProviderId::Fireworks + aliases (fireworks/fw), factory arm, token-accounts exhaustive arm, API-key settings entry (FIREWORKS_API_KEY), account-slug settings input (FIREWORKS_ACCOUNT_SLUG or the Settings field), frontend catalog + icon (upstream tagged SVG) + dashboard link. 4 unit tests incl. wire-shape fixture
z.ai CREDIT_LIMIT coding plans (steipete#2724, steipete#2712)	CREDIT_LIMIT rows now parse like TOKENS_LIMIT — the 5-hour credit window drives primary % and reset instead of sticking at 0% used. Upstream parseLimit percent math ported: positive usage total makes the absolute used signal (usage-remaining/currentValue) authoritative over the API percentage
Kimi official lane names + duplicate suppression (steipete#2741)	Membership pool lane renamed to Total usage (omni/SUBSCRIPTION pools only; feature-scoped balances skipped). Code 7-day row hidden when it duplicates the primary weekly quota (percent within 1pt, resets within 5min, reliable weekly counter — suppress only on positive evidence)
OpenRouter key-quota fast join (steipete#2778)	Optional key enrichment joins on a 1-second deadline (was 3s) and logs degraded joins explicitly; core usage stays authoritative
Menu-card detail wrapping (steipete#2742, refs steipete#2182; steipete#2846)	Long metric reset/pace details wrap to a second line (two-line clamp keeps cached card heights bounded) instead of ellipsizing — non-English locales keep full reset info

Already present (no work needed)

• DeepInfra billing-cycle spend vs positive limit (Deep Infra tracking screwy steipete/CodexBar#2822) — landed on main earlier
• Sub2API grouped quota labels + compact usage summary (Fix sub2api usage summary steipete/CodexBar#2835) — labels ("5 hour limit"/"Daily limit"/"7 day limit") and Today/Total summaries already in providers/sub2api
• Claude consent-gated CLI credentials (Claude usage stops updating on 0.47.0; refresh fails with SessionError steipete/CodexBar#2634/Claude: stop rotating CLI-owned refresh chains on keychain-only installs steipete/CodexBar#2745/CodexBar keeps reverting to old Claude account/email despite repeated sign-ins on new account/email steipete/CodexBar#2689), SSH hosts setting (Agent Sessions: make Additional SSH hosts visibly editable and improve remote diagnostics steipete/CodexBar#2804), Claude limits[]-session preference (fix(claude): prefer limits[] session over stale five_hour after 5h rollover #334), Claude sub-1% rescale (fix: stop rescaling Claude utilization below 1% to 100% #274) — verified present or in-flight separately

Skipped (no counterpart — macOS-only)

• PTY probe items (process-group kill, drain-to-close) — no PTY layer
• Swift actor-executor / QuickJS plugin thread+stack+timeout fixes — no plugin engine
• Plugin resource bundle resolution — no plugin engine
• claude-swap account rendering (Bug: Claude: cswap with two account breaks bar indicators steipete/CodexBar#2731) — no claude-swap integration
• Menu-bar token clock (Fix custom menu bar reset countdown mismatch steipete/CodexBar#2735), DeepSeek token layout (DeepSeek menu bar display is too long steipete/CodexBar#2638) — menu-bar layout-token system does not exist on Windows (per port plan: port the data, not the tokens)
• Sync duplicate usage rows — no sync feature
• Plugin usage-bars-fill (CodexBar does not respect "Usage bars fill" setting for displayed percentages steipete/CodexBar#2749) — no plugin engine
• Dock show while Settings open — no Dock

Deferred (needs deeper engine work / separate focus)

• Codex Regression in v0.48.0: Standard/Fast cost split re-inflates deduplicated fork usage steipete/CodexBar#2754/fix: keep recently modified files out of cost-store window pruning (refs #2760) steipete/CodexBar#2764/Cost pricing races the models.dev table load: rebuilds can bake ~10x-wrong prices into the store steipete/CodexBar#2772/Migrate Codex cost-usage persistence to a single SQLite database (replaces the JSON artifact) steipete/CodexBar#2760-store semantics, Handle Codex reset credits omitted after redemption steipete/CodexBar#2728 manual reset, Publish Codex quota before optional enrichment steipete/CodexBar#2799 core-quota publish, snapshot-conversion CPU fixes — the Codex cost/quota engine needs a dedicated pass; deferred with evidence rather than guess-ported
• Menu cards Menu card shows session quota available when the total quota is exhausted steipete/CodexBar#2840 (session quota exhausted until final reset of binding lanes) — depends on upstream's plan-lane binding model with no local analog yet

Commands run

• cargo fmt --all
• cargo clippy both manifests --all-targets -- -D warnings
• cargo test --manifest-path rust/Cargo.toml --lib — 1236 passed
• cargo test --manifest-path apps/desktop-tauri/src-tauri/Cargo.toml — 342 passed
• pnpm --dir apps/desktop-tauri test — 257 passed
• pnpm --dir apps/desktop-tauri run build — ok

UI proof

CUA proof for the Fireworks settings section and the menu-card wrapping is planned as a follow-up capture pass on a fresh tauri:build:debug once #336's seed tooling is mergeable (it makes deterministic captures possible). No behavior-affecting tray/settings change in this PR is verifiable via jsdom alone; calling that out explicitly per the PR template.

Note

A separate in-flight effort is concurrently implementing Claude consent-gated credentials (steipete#2634) and DeepInfra polish in this working tree; those files are intentionally not part of this PR.