limits: coalesce concurrent quota provider fan-outs

[pitimon]

Problem

The two-minute usage-limits cache has no in-flight request state. Concurrent cold requests from multiple tabs, route mounts, or refresh callers can launch overlapping fan-outs across every configured provider.

Required behavior

• Concurrent cold getUsageLimits calls join one active provider fan-out.
• A cache reset during an active fan-out does not launch a parallel second fan-out.
• Forced refresh bypasses completed cache but joins an already-active live fan-out.
• Rejected work always clears the active Promise so a later call can retry.
• Successful results keep the existing two-minute cache contract.
• refresh=1 and refresh=true remain compatible in the CLI local API and Vite development handler.

Acceptance evidence

• Tests prove one fan-out for concurrent cold calls.
• Tests prove reset during flight joins rather than duplicates work.
• Tests prove failure cleanup and retry.
• Tests prove TTL reuse and a new fan-out after a completed-cache force.
• Focused Node tests and npm run ci:local pass.
• Real local-server smoke confirms normal cache reuse and forced refresh behavior.

Scope boundary

This issue does not introduce provider-specific scheduling, stale-while-revalidate response changes, adaptive cadence, or a new endpoint.