fix(codex): derive quota expiry from exhausted windows

[codebyyassine]

Summary

Codex quota snapshots contain separate primary and secondary usage percentages and reset times. Floway previously set ratelimited_until to the later reset from either window on every 429, even when that window still had capacity. That could keep the Codex account card or upstream-list signal marked rate-limited past the reset of the quota that was actually exhausted.

This PR derives the displayed timed restriction only from windows with a finite reported usage of at least 100% and a valid reset time. When both windows are known to be exhausted, the later of those exhausted windows' known resets remains the timed restriction.

Related report from the fork: Issue #5. It is linked for context; it is not an issue in this upstream repository and is not being closed automatically.

Changes

• Add one Codex-provider-owned rule for deriving the latest known exhausted-window reset. Use it both for new rate-limit observations and for dashboard projections of already-stored snapshots that have a legacy rate-limit marker.
• Keep legacy correction non-mutating. Preserve original per-window usage, reset metadata, observation times, and quota-family separation. Successful snapshots without a rate-limit marker are unchanged.
• If an exhausted window lacks a reset, do not invent one. A known reset on another exhausted window remains visible. The displayed time is the latest known timed restriction, not a guarantee that all quota restrictions have ended.
• Add provider and control-plane coverage for exhausted/non-exhausted windows, missing or invalid values, supported reset formats, partial metadata, legacy projections, and preservation of stored state.
• Add rendered component timer coverage for the upstream-list signal and account card, plus request-path coverage that proves cached quota metadata does not gate calls, successful observations replace only their own family, and real upstream 429 status, headers, and body are preserved.

Behavior and scope

The Codex quota badge is informational. The data plane does not use ratelimited_until to reject or skip requests. Floway continues to send requests upstream and returns a real upstream 429 unchanged; this change corrects the displayed known timed restriction and leaves upstream response behavior intact.

The UI behavior was exercised locally with synthetic quota snapshots. It was not tested against a live Codex account or deployment. In particular, an expired known timer does not prove that an account with incomplete quota metadata is fully available; a subsequent upstream response remains authoritative.

Verification

• pnpm run verify passed: type generation, lint, typecheck, 599 test files / 6,488 tests, repository checks, and web build.
• Installer harness: 66 passed, 44 skipped because PowerShell is unavailable on the verification host.
• pnpm run test apps/web/__tests__/components/upstream-editor/codex-quota-expiry_test.tsx packages/provider-codex/__tests__/fetch_test.ts passed: 2 files / 82 tests.
• pnpm run lint passed.
• pnpm run typecheck passed.
• Browser check used the actual rendered Floway components with synthetic data: the badge expired as the known timer passed without a new request, while the observed 100% usage remained visible. Secondary/both-window, partial metadata, successful-observation, dark-theme, and narrow-viewport cases were also checked. No browser console errors or horizontal overflow were observed.

No deployment was performed.