refactor(quota): secure managed provider credentials (#2160)

- add shared owner-only credential storage for OpenCode Go, Ollama Cloud, and Cursor
- validate credentials before atomic writes using 0700 directories and 0600 files
- replace provider-specific credential routes with an allowlisted lifecycle API
- stop automatically reading Ollama's legacy cookie file
- stop reading or modifying Cursor's database during regular quota requests
- add explicit one-time Cursor credential import without mutating Cursor storage
- persist refreshed Cursor credentials only in OpenChamber-managed storage
- add Ollama Cloud and Cursor credential controls to provider settings
- preserve OpenCode Go tracking through the shared credential flow
- add VS Code credential management and Cursor quota parity
- reject authentication redirects, enforce request timeouts, and fail on unparseable usage pages
- mask stored secrets in API responses and extend quota security coverage
- update quota provider documentation

packages/web/server/lib/quota/opencode-go-credentials.test.js

@@ -13,7 +13,7 @@ afterEach(() => deleteOpenCodeGoCredential());
 describe('OpenCode Go credential store', () => {
   it('normalizes, masks, and stores credentials with owner-only permissions', () => {
     const status = writeOpenCodeGoCredential({ workspaceId: ' wrk_test ', authCookie: ' auth=secret ' });
-    expect(status).toEqual({ configured: true, workspaceId: 'wrk_test', authCookieMasked: '••••••••' });
+    expect(status).toEqual({ configured: true, workspaceId: 'wrk_test', secretMasked: '••••••••' });
     expect(readOpenCodeGoCredential()).toEqual({ workspaceId: 'wrk_test', authCookie: 'secret' });
     expect(fs.statSync(path.join(temporaryDirectory, 'quota', 'opencode-go.json')).mode & 0o777).toBe(0o600);
   });