Integrate CodexBar upstream through f74117ae

[ColumbusLabs]

Closes #141.

Upstream range

Reviewed 453174fe13eebdf403cc0776268eb2b101fd9553..f74117aeb7a9ee02a78c0f08ca354ff26b2292e0: 44 linear non-merge commits.

• Adapted 27 product commits into QuotaKit's 69-provider Mac/shared/mobile architecture.
• Rejected Linux-only 1c1defad and upstream-branded Stream Deck documentation 9c70890c as inapplicable.
• Rejected 15 upstream release/changelog/appcast/build-only commits; QuotaKit version, build, appcast, signing, entitlements, and release ownership remain unchanged.
• No deferred or superseded slices remain.

Product integration

• Shared Overview/dashboard spend publication, including Grok tokens and xAI spend.
• Codex PAT source and profile-aware ownership.
• OpenCode Go, Fireworks discovery, z.ai CN balance, Alibaba token discovery, and Kiro overage limits.
• Menu conditional editor expansion, localization/detail fixes, agent-session sizing, menu-item recycling, and RPC teardown hardening.
• Claude-swap retained at-limit usage, duplicate-account labeling, redacted dashboard identity, ambient fallback, and widget ownership parity.
• Backward-compatible Kiro shared/mobile sync and iPhone presentation for caps, charges, currencies, and reset times.

Independent adversarial review findings were repaired before publication, including PAT authority/identity, Fireworks config persistence, weekly pace scheduling, xAI empty-history semantics, Grok dollar coverage, cached menu identifiers, Claude alias privacy/collisions, dashboard fallback, and widget active-account consistency.

UPSTREAM_MONITOR_BASE advances to f74117aeb7a9ee02a78c0f08ca354ff26b2292e0; shipped provenance metadata remains unchanged.

Verification

• ./Scripts/lint.sh lint — pass; 69-provider manifests current, parser hash 0370dcb97ac7bb79, branding/i18n/release audits green.
• make test — 963 selections, 81/81 groups passed first attempt, zero retries/timeouts.
• swift build and swift build -c release — pass.
• Focused PAT (15), Fireworks (20), Claude/shared (89), menu/spend (103), Kiro shared/mapper (44), and iOS view (12) tests — pass.
• Generic iOS Simulator build and CodexBarSync build — pass.
• git diff --check, provider manifest, parser hash, architecture gatekeeper, and release-surface diff audits — pass.

No live credentials, Keychain prompts, CloudKit mutations, binary upload, appcast update, or release action was performed.