fix(usage): use selected native V2 Codex credentials (#811)

## Summary

I replaced Codex Usage's legacy auth-file reads with the connected
OpenCode V2 daemon's selected ChatGPT OAuth credential. This addresses
the stale-file mismatch described in #808 without guessing WSL
credential paths or substituting another account.

- Resolve the provider integration in the owned session's native
location; use only its selected active credential and native accountID.
- Keep credentials server-only, OAuth refresh native-owned, and
credential export/generic RPC blocked through the browser proxy.
- Fence warm and pending quota results on account changes, reconnects
and session movement; scope the visible panel to its instance/session.
- Bound quota HTTP, reject redirects and sanitize errors. No SQLite
access or legacy/Codex CLI fallback.

The credential-list API requires OpenCode 2.0.20 for this feature only.
Older runtimes, expired native tokens and non-ChatGPT connections fail
closed; the global application minimum is unchanged. Other providers'
credential integrations are outside this focused fix.

## Validation

- Server/UI typechecks; 85 server tests; five UI unit tests; three
rendered browser scenarios; UI build and diff checks passed.
- A fresh native 2.0.20 Windows daemon with synthetic credentials
exercises the production adapter: selected OAuth/accountID, key-account
switch invalidating a warm snapshot, and recovery despite stale
auth.json. Quota HTTP is mocked; no shared daemon or real credentials
are used.
- This fixes the confirmed integration mismatch, but I have not
reproduced the author's real WSL/live account failure.

Closes #808.

Maintenance: existing `packages/server/src/server/http-server.ts`
(~2,317 lines) and `packages/ui/src/lib/api-client.ts` (~613 lines)
exceed the source-size guideline; their wiring changes remain small.

dev-docs/OPENCODE_V2_COMPATIBILITY.md

@@ -28,6 +28,29 @@ The isolated 2.0.3→2.0.11 seed confirms native workspace-selector collapse whi
 preserving session IDs and complete history. See the
 [transition register](OPENCODE_V2_POST_BETA.md) for actual coverage and release gates.
 
+### Native Codex subscription usage
+
+Codex/OpenAI quota reads require the **2.0.20** native `credential.list` API.
+This is a feature-local dependency, not a new global minimum: a missing endpoint,
+expired token or unsupported connection yields unavailable usage. The server
+resolves the owned session's native directory and provider integration, then uses
+only that integration's first connection and its matching active ChatGPT OAuth
+credential (`chatgpt-browser` or `chatgpt-headless`). It never reads host legacy
+`auth.json`, Codex CLI credentials or SQLite, refreshes OAuth independently, or
+substitutes another saved account. WSL uses the selected daemon's credentials.
+
+Quota snapshots are scoped to the acquired native connection, instance, session,
+directory, provider and selected credential identity. Warm and pending results
+revalidate native selection before publication. Credentials remain server-only;
+browser credential export and generic RPC are still blocked by the proxy.
+Isolated HTTP/generated-client and rendered Solid fixtures cover these boundaries.
+`node scripts/test-provider-usage-native.mjs <absolute-cli-path>` additionally
+exercises the production quota adapter against a fresh native daemon/database with
+synthetic OAuth/key credentials and mocked quota HTTP only. It passed on Windows
+with 2.0.20: active-account selection and `metadata.accountID`, warm-cache revocation
+after switching to a key, and recovery despite a stale legacy file. This is not a
+real WSL or live ChatGPT quota test; no real credentials or shared daemon are used.
+
 ### Side questions (`/btw`)
 
 The composer-owned command calls native `session.generate({ sessionID, prompt })`