refactor(quota): secure managed provider credentials (#2160)

- add shared owner-only credential storage for OpenCode Go, Ollama Cloud, and Cursor
- validate credentials before atomic writes using 0700 directories and 0600 files
- replace provider-specific credential routes with an allowlisted lifecycle API
- stop automatically reading Ollama's legacy cookie file
- stop reading or modifying Cursor's database during regular quota requests
- add explicit one-time Cursor credential import without mutating Cursor storage
- persist refreshed Cursor credentials only in OpenChamber-managed storage
- add Ollama Cloud and Cursor credential controls to provider settings
- preserve OpenCode Go tracking through the shared credential flow
- add VS Code credential management and Cursor quota parity
- reject authentication redirects, enforce request timeouts, and fail on unparseable usage pages
- mask stored secrets in API responses and extend quota security coverage
- update quota provider documentation

packages/web/server/lib/quota/credentials/store.test.js

@@ -0,0 +1,26 @@
+import { afterAll, describe, expect, it } from 'bun:test';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { deleteQuotaCredential, readQuotaCredential, writeQuotaCredential } from './store.js';
+
+const previousDataDir = process.env.OPENCHAMBER_DATA_DIR;
+const temporaryDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'openchamber-quota-store-'));
+process.env.OPENCHAMBER_DATA_DIR = temporaryDirectory;
+
+describe('quota credential store', () => {
+  it('uses owner-only permissions and rejects arbitrary provider paths', () => {
+    writeQuotaCredential('ollama-cloud', { cookie: 'secret' });
+    expect(fs.statSync(path.join(temporaryDirectory, 'quota')).mode & 0o777).toBe(0o700);
+    expect(fs.statSync(path.join(temporaryDirectory, 'quota', 'ollama-cloud.json')).mode & 0o777).toBe(0o600);
+    expect(readQuotaCredential('ollama-cloud', (value) => value)).toEqual({ cookie: 'secret' });
+    expect(() => writeQuotaCredential('../escape', {})).toThrow('Unsupported credential provider');
+    deleteQuotaCredential('ollama-cloud');
+  });
+});
+
+afterAll(() => {
+  if (previousDataDir === undefined) delete process.env.OPENCHAMBER_DATA_DIR;
+  else process.env.OPENCHAMBER_DATA_DIR = previousDataDir;
+  fs.rmSync(temporaryDirectory, { recursive: true, force: true });
+});