Update Claude usage auth flow to latest headers

[kargnas]

This updates the Claude usage lookup path to follow the latest Claude Code-compatible OAuth request shape instead of relying on the older minimal header set.

Users were already authenticating successfully, but the app and the helper script were not aligned with the newer request conventions used by the reference implementation. That made the Claude integration harder to maintain and left the script and docs behind the real provider behavior.

The root cause was that the Swift provider, the shell helper, and the docs had drifted apart. The provider only set the bearer token and beta header, while the newer flow explicitly uses a Claude Code user agent, JSON accept/content headers, and no cookie dependency. The helper script also only read a single auth file even though Claude credentials can now come from multiple current sources.

This PR fixes that in two parts. First, the Claude provider now routes usage and identity requests through a shared OAuth request policy that sets Authorization, Accept, Content-Type, User-Agent: claude-code/<version>, anthropic-beta: oauth-2025-04-20, disables cookies, and supports the same environment overrides used by the reference implementation. It also adds focused tests for that request policy. Second, the bundled query-claude.sh script and the Claude API reference were refreshed to reflect the current auth source order: opencode-anthropic-auth/accounts.json, OpenCode auth, Claude Code auth, and macOS Keychain.

Validation used the existing local checks and runtime verification. make lint-swift passed, xcodebuild -project CopilotMonitor/CopilotMonitor.xcodeproj -scheme CopilotMonitor -configuration Debug -destination 'platform=macOS' -only-testing:CopilotMonitorTests test passed with 71 tests and 7 expected skips, the script was checked with bash -n scripts/query-claude.sh, and the app was rebuilt and relaunched after clearing DerivedData. Runtime logs then confirmed fresh Claude usage fetches from the rebuilt app around 2026-03-25 19:00 KST.

[op-gg-ai-devops]

Claude API 호출 시 최신 Claude Code 호환 헤더(User-Agent, 쿠키 비활성화 등)를 적용하고, 쉘 스크립트에서 키체인과 여러 JSON 경로를 순회하며 인증 정보를 찾도록 싹 업데이트했네.

ClaudeOAuthRequestPolicy로 헤더 설정 로직 깔끔하게 분리하고 테스트 코드까지 야무지게 챙긴 거 진짜 좋다. 쉘 스크립트에서 jq로 여러 인증 소스 뒤지는 로직도 예외 처리 꼼꼼하게 잘 짰음. 다만 스크립트에서 jq 파싱 실패 시 조용히 넘어가게(|| true) 해둔 부분은 나중에 인증 못 찾을 때 디버깅이 살짝 빡셀 수도 있을 것 같은데, 나중에 verbose 옵션 같은 거 하나 추가해도 좋을 듯. 쿠키 명시적으로 날린 것도 보안상 아주 훌륭함.

---

이건 짧은 요약 프리뷰임. 상세한 라인별 코드 리뷰(버그 탐지, 보안 체크 포함)를 원하면 @op-gg-ai-devops 리뷰해줘라고 댓글을 남기거나, @op-gg-ai-devops를 리뷰어로 추가해 줘 (PR에 커밋 푸시될 때마다 자동으로 리뷰해 줌).