Persist and reconcile Usage history

[merefield]

Why

Usage history previously lived only in process memory. Restarting Codexometer discarded the displayed history until the next successful OpenAI refresh, local detail could not be recovered after an absence, and a transient refresh failure made Usage unavailable even when verified data had already been seen.

This PR establishes one content-free historical truth layer shared by the terminal and experimental web interfaces. OpenAI daily totals remain authoritative; retained local rollout telemetry adds attribution without being double-counted.

What changed

• add a versioned, locked and atomically replaced usage-history ledger with approximately 400 days of retention
• isolate data using a one-way account fingerprint and require the current invocation to verify that account before reopening cached history
• upsert OpenAI daily usage buckets and optional lifetime/peak/streak/longest-turn summaries
• recover daily input, cached-input, output, reasoning and total-token aggregates from retained local Codex rollouts
• make recovery idempotent across refreshes/restarts and reuse unchanged per-rollout scans within a running process
• retain content-free quota percentage/reset observations as groundwork for later quota-history visualisations
• expose OPENAI / RECOVERED / PARTIAL provenance, local attribution percentage, longest turn and longest streak in both TUI and web Usage views
• retain the last verified Usage result as a clearly labelled stale cache when a later refresh fails
• update every supported terminal locale, the README, intro post and embedded web assets

The ledger never stores prompts, replies, commands, source content, paths, session IDs, email addresses, credentials or authentication tokens. A local persistence failure does not hide a valid current OpenAI response.

Verification

• full Go race suite: go test -race ./...
• go vet ./...
• Windows amd64 and macOS arm64 cross-builds
• Svelte type checking and formatting
• 39 Playwright browser regressions against the rebuilt binary
• dedicated restart, stale-cache, account-isolation, permission, duplicate-recovery, missing-vs-empty, quota-window identity and cross-platform lock tests

Official app-server behaviour used here: account/usage/read supplies optional account summary fields and daily token buckets; account/rateLimits/read supplies current quota snapshots rather than historical quota movement.