feat(cli): add provider capacity command

[codeaholicguy]

Summary

• add ai-devkit capacity [provider] [--json] [--max-age <seconds>] [--refresh]
• detect configured providers from ENVIRONMENT_DEFINITIONS.globalSkillPath, not PATH
• read Codex limits through codex app-server --stdio and account/rateLimits/read without a model turn
• detect Claude authentication safely; keep undocumented live usage guarded off
• report Pi/GLM and other configured providers honestly as unsupported/unknown
• normalize arbitrary provider windows with daily/weekly aliases and report reset-credit counts without redemption
• parallelize isolated probes and cache only normalized data with restrictive permissions

Security

• no tokens, account IDs, refresh tokens, URLs, headers, raw response bodies, stderr, or exception text are emitted or cached
• no secrets are passed on command lines
• Codex probing uses only account rate-limit reads; there is no model-turn or reset-credit consume path
• partial failures degrade to fixed error codes and available: unknown

Validation

• cd packages/cli && npm run lint (exit 0; 5 pre-existing warnings)
• cd packages/cli && npm test (85 files, 953 tests passed)
• cd packages/cli && npm run build (207 files compiled)
• cd packages/cli && npm run test:coverage (85 files, 952 tests at that checkpoint; 71.47% statements, 72.77% lines; capacity core 80.59% statements, 85.98% lines)
• node packages/cli/dist/cli.js capacity --json --refresh (exit 0; configured providers only; Codex live limits and reset credits normalized)
• node packages/cli/dist/cli.js capacity --max-age=-1 (exit 1)
• node packages/cli/dist/cli.js agent list --json (exit 0)

Provider notes

• Codex: supported live capacity via provider-owned app-server protocol.
• Claude: auth detection only; live capacity remains unknown because no safe provider-owned usage command exists and the OAuth endpoint is undocumented.
• Pi/GLM: authentication detection only; no verified authoritative quota mechanism, so availability remains unknown.
• Other configured providers: displayed as unsupported with unknown availability.