feat: add optional OpenAI multi-account quota support

[christian-taillon]

Summary

Adds optional, read-only OpenAI multi-account quota discovery from the global oc-codex-multi-auth account pool at ~/.opencode/oc-codex-multi-auth-accounts.json.

• Supports V1 and V3 storage; missing, malformed, unsupported, or partially unusable storage does not disable native OpenAI quota.
• Queries only already-cached access tokens with bounded fan-out. Never refreshes, exchanges, rotates, or persists credentials. Project-specific account pools are out of scope.
• Displays subscriptions independently with provider-reported plans, safe fallbacks, and one distinct group per account across all quota windows. Conservatively removes proven native/multi-auth duplicates and preserves partial success.
• Uses protected resolved-auth identities for the complete native/global account set, with order-independent composition and uncached fallback when a contributing identity cannot be safely resolved. Native-only cache identity behavior is preserved.
• Keeps exportable source IDs separate from cache identities: no email or credential fingerprints. OpenAI HTTP errors never include response bodies; arbitrary parser/transport exceptions are also withheld to avoid leaking identity material.
• Preserves current-main quota parsing and TUI packaging. No OpenAI-specific quota-state cache-key suffix or identity diagnostics.

Linked Issue

No linked issue. This is a focused compatibility addition for multi-subscription OpenAI/Codex setups.

Validation

• pnpm verify — passed locally: 188 test files, 2,260 tests passed, 1 skipped; build, typecheck, four-surface parity, and package-contents verification passed.
• Focused reader, cache-policy, query, provider, native-storage fallback, and accounting-projection regressions.
• git diff --check and final diff inspection against current upstream main.

OpenCode Validation

• Installed OpenCode: 1.18.25, confirmed with opencode --version.
• opencode debug startup and opencode debug config exited successfully with isolated HOME/XDG directories; resolved configuration includes the built plugin entrypoint. These are CLI startup/configuration smoke checks, not live multi-account quota or interactive TUI tests; plugin activation was not independently confirmed by these commands.
• Server/TUI integration and packaged-module regression tests run through pnpm verify.
• The earlier PR reported testing on 1.18.21; no new live-account validation is claimed here.

Quality Checklist

• I ran the complete canonical pnpm verify gate successfully
• This change is focused and avoids unrelated behavior changes
• I updated or added tests when behavior changed
• I updated docs for the global-only, read-only scope
• Existing current-main OpenAI tests and packaging implementation are preserved

[christian-taillon]

Updated feat/openai-multi-account-quota and pushed a1aee53.

• Merged the latest slkiser:main and resolved the OpenAI provider, auth-cache, and test conflicts.
• Preserved the multi-account quota behavior and upstream auth-identity/cache security changes.
• Local validation: typecheck passed, build passed, 187 test files / 2,228 tests passed, v4 history and TypeScript release gates passed.
• Package contents also verified from a dry-run pack manifest.

Please review when available; this branch is ready for the PR checks to rerun.

[christian-taillon]

The updated head a1aee53 is now mergeable. GitHub Actions run 34149437771 is currently action_required with no jobs reported, so maintainer approval may be needed before CI starts.

[christian-taillon]

Pushed follow-up commit 4592f64 to feat/openai-multi-account-quota with additional OpenAI multi-account hardening and storage-isolation tests. Local validation: TypeScript, build, formatting, and 112 focused tests pass. The new CI run 34150441173 is still action_required with no reported jobs; maintainer approval is still needed to start it.

[christian-taillon]

Updated against current main and ported the multi-account integration onto the resolved-auth cache architecture. Native OpenAI behavior and current privacy/error handling are preserved; multi-auth remains global-store-only and read-only. pnpm verify passes. OpenCode 1.18.25 was checked with CLI startup/configuration smoke tests.