feat(webui): add context budget controls

[Calmingstorm]

Summary

Final build phase of the context-budget campaign (plan §12):

• adds the Context budgets table to Codex Advanced settings with backend-derived built-in floors, editable overrides, effective budgets, resulting character targets, provenance, learned-clamp expiry, and reset controls
• persists overrides and utilization through the existing explicit Advanced save boundary
• adds account-and-model-scoped temporary-clamp clear controls backed by POST /api/context/windows/clear
• keeps derivation authority in GET /api/context/windows; the browser never recomputes targets
• adds read-only effective budget/provenance discoverability to the Codex basic grid
• preserves unsaved policy drafts across stale refreshes, unrelated saves, and clamp clears; sequence-fences overlapping context-window reads
• extends backend management truth with eligible, non-expired clamp rows and truthful effective-clamp expiry
• rebuilds ui/dist

Validation

• full Python suite: 9,538 passed / 6 skipped
• focused observer/admin suite: 190 passed
• npm run check: passed, including templates, template bindings, UI race/save-boundary gates, and byte-current dist build
• Ruff: clean
• lint gate: 0 findings
• type gate: 0 findings
• apply-registry gate: 0 findings
• coverage gate: 0 findings
• git diff --check: clean

Visual verification

Authenticated-shape mock navigation and interaction were rendered at 1600, 800, and 390 CSS-pixel widths. Each viewport showed seven canonical models, no document or panel horizontal overflow, responsive cards below 900px, backend-derived values, override and temporary-clamp provenance, expiry copy, and the account-scoped clear action.

No deployment or release pipeline was run.

[Calmingstorm]

LGTM — approved at 5aaa547. Verification record:

Visual (Aaron's bar): all three renders reviewed — 1600px table, 800px two-column cards, 390px single-column; no horizontal overflow; Config Center idiom held; provenance chips with clamp expiry; honest activation copy. Every displayed derivation checked against the exact integer math: spark 205,002 / 5.4+terra 1,271,257 / 5.4-mini 550,365 / 5.5 570,002 / overridden luna 800K→1,095,000 / clamped sol 300K→575,000 — all exact, all server-served.

Mutation verification, four load-bearing gates: (M-A) dropping context_budget_overrides/context_utilization from the ADVANCED payload boundary crashes the save-boundary gate; (M-B) removing the fetchContextWindows sequence fence crashes its older-response-overwrites-newer assertion; (M-C) ignoring eligibility in account_clamps() fails its pin; (M-D) removing the override ValidationError catch fails 3 parametrized bounds cases. Clean controls pass on all four.

Contract checks: browser renders GET /api/context/windows verbatim (rows bind server fields only — no client-side derivation anywhere); one eligibility snapshot per management response (rows and resolution cannot disagree); canonicalization proven through the save path (codex-auto-review → gpt-5.6-luna); draft protection covers late GETs, unrelated saves, and clamp clears with the revision-aware dirty-clear; _eligible_keys refactor preserves the #275 fail-open-not-stale contract.

Independent gates at 5aaa547: Python suite 9,539 passed / 5 skipped; coverage findings=0; lint new=0; type new=0; apply-registry clean; npm run check exit 0 with the committed dist byte-current (built hashes match); diff-check clean; CI green.

Merging to the campaign branch.