What changed

Closes #2764.

• adds a provider-neutral personal-allowance capability registry and normalized Tauri command surface
• adds Auto / Codex / Claude / Grok capability cards under Settings → Experiments
• makes provider-account reads explicit opt-in; the preview is off by default
• persists only the selected provider and keys cached reads by provider
• shows the constraining allowance in global app chrome, with the detailed indicator retained in Settings
• refreshes every five minutes while active, on focus return, or manually
• implements Codex through the locally authenticated app-server
• preserves valid rate-limit windows when optional token totals are unavailable
• accepts modern map-only rateLimitsByLimitId responses while retaining the legacy fallback
• keeps Claude and Grok visible but disabled with honest unsupported reasons
• adds bounded JSONL handling, ordered initialization, stable redacted errors, response-ID correlation, timeout/process-tree cleanup, and invalid-shape rejection

Why

Users should be able to see the constraining window on their personal AI provider allowance without leaving Buzz. The architecture remains provider-neutral without pretending that organization API billing, agent token/cost history, or scraped consumer pages are equivalent to personal subscription allowance.

This is complementary to #2035: that PR covers agent token/cost history from NIP-AM; this PR reads the signed-in user's local provider allowance. It deliberately does not add a /usage command or duplicate that agent-usage surface.

Privacy

The preview is disabled by default. When a user opts in, the Codex adapter reuses the existing local Codex sign-in. Buzz stores only the non-secret provider preference. No credentials, raw responses, account identifiers, or provider error bodies cross IPC or enter logs, analytics, crash payloads, or Nostr. Only provider, product, source, plan, normalized windows, optional totals, and freshness reach the frontend. Claude and Grok expose capability metadata only and make no provider calls.

Validation

Exact head: 9e2dad3ad142b182b7301a979394fc581dab5153

• full repository just ci passed against the exact committed SHA
• workspace/Desktop Rust formatting and clippy passed with warnings denied
• Desktop, web, and mobile static analysis and production builds passed
• complete repository unit-test matrix passed
• provider E2E: 2/2 passed, covering default-off consent/opt-in and provider-scoped multi-window rendering
• provider Rust regressions cover optional totals failure and map-only rate limits
• git diff --check passed
• required Co-authored-by and Signed-off-by trailers are present

The same hardening commit is also carried in the isolated Canary branch at 4e40792f5af421c702031449e57e64bae1d35983; its full just ci run passed independently before push.

Manual test

1. Open Settings → Experiments and confirm Provider usage indicator is off by default.
2. Enable it, then choose Auto or Codex.
3. Confirm global app chrome shows the lowest remaining supported allowance window.
4. Open the popover and confirm all returned windows and reset times appear.
5. Refresh, leave Buzz focused for a refresh interval, restart Buzz, and confirm the preference and provider-scoped data remain coherent.

Deferred

• Claude personal allowance until Anthropic exposes a supported standalone read contract
• Grok consumer allowance until xAI exposes a supported read contract
• organization API billing, purchasing credits, and agent token/cost history