Phase 3: usage screen

GET /usage serves the numbers behind Claude Code's /usage, read with the
CLI's own stored OAuth credentials (nothing to configure). The endpoint
is undocumented, so parsing is defensive -- the generic limits[] array
becomes labeled window bars, unknown kinds surface under their raw name,
and any failure degrades to an 'unavailable' snapshot with the reason.
One UsageProvider per paid service behind a caching monitor that
enforces the >=180s minimum poll regardless of phone refreshes; no
background polling at all. ureq (rustls) does the outbound call, with
the process-level CryptoProvider now chosen explicitly in main -- ureq
brings ring while axum-server brings aws-lc-rs, and with both in the
graph rustls refuses to guess.

App: a Usage screen off the session list -- per-window bars colored by
utilization with relative reset times. Verified live: 74%/26%/16%
windows rendered against the real endpoint.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017xn8nHw1tw1R6PtiY1eEtw

server/Cargo.toml

@@ -30,6 +30,14 @@ qrcode = { version = "0.14", default-features = false }
 # The wg0-bound listener needs the interface's address; the stdlib has no
 # getifaddrs. This is the smallest crate that wraps just that.
 if-addrs = "0.15"
+# Outbound HTTPS for the usage endpoint. A small blocking client fits an
+# every-few-minutes poll better than pulling in reqwest's tower stack;
+# rustls-backed like the rest of the TLS here.
+ureq = "3"
+# Direct dependency only to pick the process-level CryptoProvider in main:
+# ureq pulls rustls-with-ring, axum-server rustls-with-aws-lc-rs, and with
+# both in the graph rustls refuses to auto-select one.
+rustls = "0.23"
 
 [dev-dependencies]
 tempfile = "3"