Implement capsule usage quota overlay

[donbeave]

Summary

• implemented Capsule usage/quota data flow end to end: daemon-owned extraction/cache, normalized control replies, active-tab status signal, prefix-u overlay, refresh dispatch, stale/disconnected/error states, and atomic /jackin/run/usage/accounts.json snapshots
• added Turso-backed telemetry storage for Capsule plus explicit host cache sync/read commands under jackin usage, with no silent host writes
• added provider adapters and verification paths for Claude Code, Codex, Amp, Grok Build, GLM/Z.AI, Kimi, MiniMax, and OpenCode; hardened Kimi expiry handling plus ZAI/MiniMax host and endpoint aliases
• updated operator/contributor docs and the roadmap item with the current shipped scope, provider references, local verification notes, and remaining blocked work

Verification

• cargo fmt --all --check
• cargo test -p jackin-capsule usage -- --nocapture
• cargo test -p jackin-capsule telemetry -- --nocapture
• cargo test -p jackin-capsule focused_usage -- --nocapture
• cargo test -p jackin-capsule account_usage -- --nocapture
• cargo test -p jackin-capsule kimi_local_token_loader -- --nocapture
• cargo test -p jackin-capsule zai_url_normalization -- --nocapture
• cargo test -p jackin-capsule minimax_remains_urls -- --nocapture
• cargo test -p jackin --lib (one pre-existing unrelated /private/var vs /var global Kimi mount test still fails locally)
• from docs/: bun run build, bun run check:repo-links, bunx tsc --noEmit, bun test, bun run check:roadmap-sidebar
• codebook-lsp --root . lint --unique crates/jackin-capsule/src/daemon.rs crates/jackin-capsule/src/telemetry_store.rs docs/content/docs/reference/roadmap/capsule-usage-quota-overlay.mdx

Local Provider Verification

• Claude Code: local CLI/subscription extraction works.
• Codex: local account/read and account/rateLimits/read extraction works.
• Amp: local amp usage extraction works.
• Grok Build: local auth detected; ACP billing probe returns Method not found, so jackin' records credential presence and unsupported billing state safely.
• Kimi: local credential files found, but stored OAuth tokens are expired; adapter now skips expired tokens instead of probing with stale credentials.
• GLM/Z.AI and MiniMax: adapters and endpoint overrides are implemented; live verification still needs explicit keys or provider injection on this host.

Remaining Work

• Long-running host-global refresh daemon remains blocked on the separate jackin' daemon roadmap foundation; this PR keeps provider polling in the Capsule daemon and exposes host writes only through explicit sync.
• Future provider parity depends on upstream APIs for Grok Build billing and refreshed/explicit credentials for Kimi, ZAI, and MiniMax.
• CI is rerunning for the latest head after the spelling fix commit.