[codex] Fix repeated Keychain prompts and harden credential access

[Shuo-O]

What changed

• make Claude Keychain access explicit opt-in instead of reading credentials on every refresh
• cache the Keychain lookup so it happens at most once per app launch
• harden the OAuth request with an ephemeral, cookie-free session and strict response validation
• support stable code-signing identities and stop swallowing signing failures
• add privacy-default coverage and update Chinese/English documentation
• include the pending PNG icon rendering improvements and shared AI coordination files

Why

QuotaBar was ad-hoc signed and queried Claude Code's Keychain credential every 60 seconds. Rebuilding changed the app's code identity, so macOS could not persist the user's authorization and repeatedly displayed a password prompt.

The new default avoids Keychain access entirely. Users who explicitly enable exact online Claude usage get at most one Keychain lookup per launch. A stable Apple Development or Developer ID identity can be supplied for permissions that survive rebuilds.

Impact

• existing users stop seeing recurring Keychain prompts after installing the new build
• local JSONL usage remains available without credential access
• exact Claude API usage remains available as an informed opt-in
• OAuth tokens are not persisted or logged by QuotaBar

Validation

• swift test — 1 test passed
• Scripts/package_app.sh — release build completed
• codesign --verify --deep --strict --verbose=2 build/QuotaBar.app — passed
• staged secret-pattern scan and git diff --cached --check — passed