feat(desktop): add local provider allowance indicator

[NYTEMODEONLY]

What changed

Closes #2764.

• adds a provider-neutral personal-allowance capability registry and normalized
  Tauri command surface
• adds Auto / Codex / Claude / Grok capability cards under
  Settings → Experiments
• persists only the selected provider and keys cached reads by provider
• generalizes the sidebar indicator and popover for multiple rolling windows
• implements Codex through the locally authenticated app-server
• keeps Claude and Grok visible but disabled with honest unsupported reasons
• adds bounded JSONL handling, ordered initialization, stable redacted errors,
  response-ID correlation, timeout/process-tree cleanup, and invalid-shape
  rejection

Why

Users should be able to see the constraining window on their personal AI
provider allowance without leaving Buzz. The architecture must remain
provider-neutral without pretending that organization API billing or scraped
consumer pages are equivalent to personal subscription allowance.

Privacy

The Codex adapter reuses the existing local Codex sign-in. Buzz stores only the
non-secret provider preference. No credentials, raw responses, account
identifiers, or provider error bodies cross IPC or enter logs, analytics, crash
payloads, or Nostr. Only provider, product, source, plan, normalized windows,
optional totals, and freshness reach the frontend. Claude and Grok expose
capability metadata only and make no provider calls.

Validation

• exact commit: 83a9e156ca773bb542244b6d359c7666427544ab
• full just desktop-ci: static checks, TypeScript validation, production
  build, Cargo check, Rust formatting, and all Desktop tests
• 3,490 frontend tests
• 1 rendered Playwright regression covering the provider picker, every returned
  window, constraining-window selection, and persistence
• 1,633 Tauri/Rust tests passed; 14 real-keychain/relay tests ignored as
  expected
• 3 Rust mixer diagnostics passed
• exact-commit installed Buzz Canary verification across channel, DM, Agents,
  Settings, manual refresh, focus return, explicit Codex selection, and restart
• provider selection persisted after restart; manual refresh advanced freshness;
  all returned allowance windows and optional totals rendered

The broader repository just ci reaches untouched mobile code and is blocked
locally because this Mac has Dart 3.10.7 while the repository requires Dart
3.11.4 / Flutter 3.44.8. Desktop CI is fully green.

Manual test

1. Enable Provider usage indicator in Settings → Experiments.
2. Choose Auto or Codex.
3. Confirm the sidebar shows the lowest remaining supported allowance window.
4. Open the popover and confirm all returned windows and reset times appear.
5. Refresh, restart Buzz, and confirm the preference and last successful
   provider-scoped data remain coherent.

Deferred

• Claude personal allowance until Anthropic exposes a supported standalone read
  contract
• Grok consumer allowance until xAI exposes a supported read contract
• organization API billing, purchasing credits, and agent token/cost history