fix: follow live Codex rate limits

[ChrisOsegueda]

Summary

• prefer the installed Codex CLI app-server rate-limit snapshot over stale rollout data
• parse the current camelCase, multi-bucket account/rateLimits/read response while selecting the primary codex bucket
• ignore legacy rollout windows that were already expired when recorded
• retain recent-session fallback for older or unavailable Codex installations
• update source labels, privacy documentation, architecture notes, and changelog

Verification

• DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer make test (88 tests)
• DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer make build
• temporary live smoke test against Codex CLI 0.144.3 confirmed the app-server client returns a parseable current snapshot

Context

Codex 0.144.3 returned a current weekly-only codex bucket through its app-server, while recent rollout JSONL still carried an expired legacy five-hour window. The old local-only reader accepted that stale window, causing the five-hour meter to remain visible with invalid data.