[Feat] Show subscription provider usage on Models settings

[mrubens]

What

Adds a usage line under the ChatGPT, GitHub Copilot, and Kimi for Coding provider rows in Settings > Models, showing current plan usage such as remaining Copilot premium requests or percent used of the 5-hour and weekly rate-limit windows, with reset times.

How

• packages/types: new normalized SubscriptionProviderUsage / SubscriptionUsageWindow types plus the provider usage endpoint constants.
• packages/db: getSubscriptionProviderUsage() with one fetcher per provider, reusing credentials the deployment already holds:
  • Copilot: copilot_internal/user with the stored OAuth token, reading the premium_interactions quota snapshot.
  • ChatGPT: backend-api/wham/usage via getFreshChatGptAccessToken(), so it rides the existing advisory-locked refresh.
  • Kimi for Coding: the Kimi Code usage endpoint with the configured KIMI_API_KEY, with a /v1/usage fallback on 404.
• apps/web: admin-gated subscriptionUsage.list tRPC query and the usage line rendering in InferenceProviderSection (1 minute stale time). Only normalized numbers reach the client, never tokens.
• apps/docs: short note on the new usage display in models.mdx.

Notes on the upstream endpoints

None of these usage endpoints are officially documented; each is the endpoint the provider's own CLI polls for its usage display. Live payloads were verified against all three providers and differ in places from what third-party tooling documents (ChatGPT now nests windows under a singular rate_limit key; Kimi serializes numbers as strings and uses proto-style enum values). Parsers accept the known field aliases, the live shapes are pinned in tests, and any fetch/parse failure resolves to null so the UI omits the usage line rather than erroring. Window labels are derived from the reported window durations rather than hardcoded, so label text survives upstream window changes.

Testing

• 12 unit tests covering the parsers (documented and live payload shapes), 404 fallback, not-connected short-circuits, and aggregator failure isolation.
• Verified end-to-end against all three live provider APIs on a connected deployment.
• pnpm lint, pnpm check-types, pnpm knip, and the full packages/db lib suite pass.

[roomote-roomote]

No new code issues found. See task

• apps/web/src/components/settings/InferenceProviderSection.tsx:817 The new subscriptionUsage tRPC dependency is not added to this component's mocked useTRPC client, so every test in InferenceProviderSection.test.tsx now throws before rendering. Extended the mock and added usage-state coverage.
• apps/web/src/components/settings/InferenceProviderSection.tsx:816 The one-minute usage query is never invalidated after saving an API-key provider, connecting a subscription, or reconnecting one. Added subscriptionUsage.list invalidations for save, delete, disconnect, and successful subscription connections.

_{Reviewed 73a786d}

[mrubens]

Addressed the review feedback:

• CodeQL (URL substring check): the aggregator test's mock fetch now matches the hostname exactly instead of using a substring check (a366fd4).
• Component test mocks: the InferenceProviderSection test's useTRPC/useQuery mocks now cover the subscriptionUsage dependency, plus two new tests for the usage line (rendered under connected rows, hidden on errored rows or missing data) (73a786d).
• Stale usage after provider changes: subscriptionUsage.list is now invalidated alongside the existing provider/status invalidations: save provider, delete provider, disconnect either subscription, and successful completion of both connect dialogs (73a786d).