feat(cli): add provider capacity command

[codeaholicguy]

Summary

• add ai-devkit capacity with provider selection, JSON output, cache age, and refresh controls
• keep the multi-provider architecture with truthful unknown states for unsupported or missing capacity
• normalize provider windows and secure normalized caching

Rework

• rebase onto current origin/main
• resolve Codex auth from CODEX_HOME/auth.json or ~/.codex/auth.json
• prefer PAT whoami plus wham/usage, then fresh OAuth wham/usage, then the Codex CLI fallback
• fall through from failed PAT to fresh OAuth when available; stale or unauthorized OAuth falls back without refresh
• run the fallback as codex -s read-only -a untrusted app-server and read both account/rateLimits/read and account/read
• map session and weekly limits, credit balance, the individual-limit fallback chain, additional limits, reset timestamps, and source into UsageSnapshot
• preserve unavailable as distinct from zero usage

Security

• never log or cache PATs, access tokens, refresh tokens, raw auth.json, headers, bodies, stderr, or raw exception text
• never refresh OAuth credentials; Codex owns credential lifecycle
• never invoke a model turn or redeem reset credits
• all network and subprocess behavior is mocked in tests

Validation

• npm ci
• npm run build (six projects; 217 CLI files compiled)
• npm run lint (exit 0; six pre-existing warnings, zero errors)
• npm run test (145 files; 1,961 tests passed)
• npm run test:e2e (41 tests passed)
• npx ai-devkit@latest lint --feature capacity-command (exit 0; one branch-name warning)

Provider notes

• Codex: tiered PAT, OAuth, and hardened provider-CLI capacity reads
• Claude: authentication detection only; capacity remains unknown
• Pi and GLM: authentication detection only; capacity remains unknown
• other configured providers: unsupported with unknown availability