feat(cli): codeburn quota command reading provider capacity from the CLI

[iamtoruk]

First step of Windows menubar parity.

Provider quota/capacity reading lives only inside the Electron desktop app today (TypeScript adapters under app/electron/quota/) and inside the macOS menubar (native Swift). Non-Mac surfaces, starting with the Windows Tauri tray, have no way to show it. This moves the reading into the CLI so every surface can consume one payload.

What this adds

codeburn quota reads the six providers in parallel, each with a short timeout, and always exits 0:

• codeburn quota prints a table of every provider and its windows
• codeburn quota --format json prints the machine payload

{ "providers": [ { "id", "name", "available", "plan?", "windows": [ { "label", "usedPct", "resetsAt?" } ], "error?" } ] }

Add-only payload, per the CLI-app contract. A provider with no credentials on the machine is reported available: false with no error field, so an absent tool never reads as a failure.

Adapters ported: Claude, Codex, Gemini, GitHub Copilot, Antigravity, Kimi, plus the shared credential-reading and keychain helpers. Read logic and credential discovery are unchanged from the Electron originals.

Two deliberate differences, both aimed at non-Mac surfaces:

• Antigravity discovery uses ps and lsof, which Windows has no equivalent of, so it reports a clean disconnected there instead of a spawn failure.
• Codex reads ~/.codex/auth.json directly rather than preferring the macOS menubar's cached OAuth. That cache is read-only to this process and goes stale, which degraded a perfectly good on-disk credential to "temporarily unavailable".

Electron copies untouched

app/electron/quota/ is unchanged and is still what the desktop app runs, so this PR carries no regression risk for the desktop. The new src/quota/index.ts names those files as the origin. The two trees get deduped in a follow-up once the surfaces read the CLI.

Verification

• npx vitest run tests/quota-providers.test.ts green (14 tests): one decode plus one unavailable path per provider, the JSON envelope shape, and the per-provider timeout. No test touches the network; fetch and file reads are injected.
• npx vitest run tests/quota.test.ts still green (17 tests). That file covers the unrelated src/quota.ts pace model, which keeps its name.
• npx tsc --noEmit clean.
• node dist/main.js quota --format json on a Mac with real credentials returns in ~0.5s, exit 0, with Claude read from the keychain and Codex from disk.