fix(sidebar): resolve stale per-session active account display

[iceteaSA]

Bug (operator-hit, live)

A session's sidebar kept showing work-alt as the active account while its subagent children were actively serving from a newly added fallback (client-alt). Live state: the session's per-session activeRouting entry pointed at work-alt, which had since hit 100% used (reset days in the future). The entry was honored because resolveSessionSidebarRouting only checks that the target account exists, is enabled, and isn't killed — never its quota. The fallthrough had the same blindness: it picks the first enabled fallback, which was again the exhausted one.

Additionally, subagent serves never refresh the parent session's routing entry, so a parent TUI idles on stale data while its children serve from a different account.

Fix (display-layer only; real routing untouched)

• sidebar-state.ts — isQuotaExhausted(quota, now): primary window usedPercent >= 100 with resetsAt in the future. Unknown/missing/malformed quota is not exhausted (fail-open, consistent with the killswitch doctrine). resolveSessionSidebarRouting rejects a session entry whose target account is exhausted, and the fallthrough prefers the first non-exhausted enabled fallback (array order preserved; all-exhausted keeps prior behavior).
• index.ts — the fetch override captures x-parent-session-id (before header rewriting) and, on a serve, upserts the routing entry for both the child and the parent session (same activeId/route, parent !== child guard, best-effort, same compare-and-retry RMW path as all routing writes).
• resolveQuotaDialogActiveId already delegates to the shared resolver — the /openai-quota dialog inherits the fix.

Verification

• RED-first: resolver tests reproduce the exact live state (exhausted work-alt + healthy client-alt → old code returns work-alt, fixed code returns client-alt); parent-entry-absent RED for the upsert; EISDIR best-effort RED.
• Edge cases pinned: past resetsAt (elapsed window ≠ exhausted), missing/null quota honored, all-fallbacks-exhausted preserved, main exhaustion symmetric, parent === child guard.
• Review (gemini-3.1-pro): APPROVE 0 must / 0 should — exhaustion predicate edges, RMW/compare-retry on the parent upsert, display/routing separation, updatedAt vs pruning clamp all verified; RED claims confirmed by reverse-applying the diff.
• Gates: build ✓ · tsc ✓ · full suite 682/0 ✓ · biome clean.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

---

Summary by cubic

Fixes the sidebar’s per-session active account display so exhausted accounts aren’t shown as active, and parent sessions reflect the account actually serving via child sessions.

• Bug Fixes
  • Treat an account as exhausted when primary.usedPercent >= 100 with a future resetsAt; missing/unknown/malformed quota stays usable.
  • Prefer the first non-exhausted enabled fallback; if all are exhausted, keep prior behavior.
  • On serve, upsert routing for both child and parent sessions using x-parent-session-id (when present and different). Best-effort write; request routing is unchanged.
  • The /openai-quota dialog uses the shared resolver and reflects these rules.

^{Written for commit 4686858. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 4 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>