Let a session resume itself when its usage limit lifts

Off by default and per session: it spends quota the moment quota exists,
with nobody watching, which is not a thing a default may decide. Switched
on from the session settings dialog, with the message it sends editable
("continue" unless something else is typed).

Running out of quota becomes a state rather than an error. The Claude
driver recognises its dialect's sentence -- `Claude AI usage limit
reached|1788546972` -- and reports `LimitReached` with the reset time it
gave; nothing above a driver matches on a string. The transcript draws it
as a divider, like a clear or a compaction.

The schedule is a plan to *ask*, never a plan to send. Both reset times
available are untrustworthy in the direction that matters -- the dialect's
is written when the turn fails, the endpoint's moves when the window does
-- so the wait ends in a question to the usage meter, and only `ok` with
no window at 100% sends anything. A window still spent reschedules to its
own reset time, which is what makes a limit that lifts late wait longer
and one that lifts early resume sooner. A meter that cannot be asked is a
longer wait too, never a send. A day after the limit was hit the wait
gives up and says so in the transcript, so a machine that can never be
asked is not retried for ever.

The schedule is persisted on the session: a five-hour window outlasts a
backend restart, and a wait forgotten across one never comes back.

Driven end to end with echo, never a real account: `/limit [minutes]`
reports the same event a real driver does and `/usage` sets what the meter
answers, deliberately separate so the two can disagree. The wait moved
from the dialect's two minutes to the meter's seven when the meter changed
its mind, and the message went out on the first check after the meter came
back under the limit.

Also makes the settings dialog scrollable, which these two controls made
necessary: at a 1.5x system font it clipped the last of them with nothing
on screen to say so.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/src/session/claude/translate.rs

@@ -224,12 +224,12 @@ impl Translator {
                         .and_then(Value::as_bool)
                         .unwrap_or(false)
                 {
-                    events.push(Event::Error {
-                        message: message
-                            .get("result")
-                            .and_then(Value::as_str)
-                            .unwrap_or("the turn ended with an error")
-                            .to_string(),
+                    let said = message.get("result").and_then(Value::as_str);
+                    events.push(match said.and_then(usage_limit) {
+                        Some(resets_at) => Event::LimitReached { resets_at },
+                        None => Event::Error {
+                            message: said.unwrap_or("the turn ended with an error").to_string(),
+                        },
                     });
                 }
                 let context = self.context.take();
@@ -603,6 +603,37 @@ impl Translator {
     }
 }
 
+/// Whether a failed turn failed because the account is out of quota, and when
+/// the CLI said the limit lifts.
+///
+/// The wording is the CLI's: a turn stopped by the limit ends with `is_error`
+/// and a result of `Claude AI usage limit reached|1788546972`, the reset being
+/// epoch seconds after a pipe. Matched on the sentence rather than on a code
+/// because the CLI sends none, so this is deliberately loose about everything
+/// but the four words.
+///
+/// The two `None`s mean different things and both are real. The outer one is
+/// "some other failure". The inner one is "the limit is reached and the CLI did
+/// not say until when" -- which is not a reason to invent a time: `crate::resume`
+/// asks the usage endpoint before sending anything, and that answer is the one
+/// that decides.
+///
+/// Milliseconds are accepted as well as seconds and told apart by magnitude,
+/// since a wrong guess would schedule a resume tens of thousands of years out
+/// and look exactly like auto-resume being broken.
+fn usage_limit(result: &str) -> Option<Option<f64>> {
+    if !result.to_ascii_lowercase().contains("usage limit reached") {
+        return None;
+    }
+    let stamp = result
+        .rsplit('|')
+        .next()
+        .and_then(|tail| tail.trim().parse::<f64>().ok())
+        .filter(|stamp| *stamp > 0.0)
+        .map(|stamp| if stamp > 1e11 { stamp / 1000.0 } else { stamp });
+    Some(stamp)
+}
+
 /// A string field that is there and not empty, or `None`. The CLI omits these
 /// rather than sending them empty, but a caller that sends `""` means the same
 /// thing and should not produce a description that draws as a blank line.
@@ -1275,6 +1306,55 @@ mod tests {
         );
     }
 
+    /// Running out of quota is a state, not a failure of the work.
+    ///
+    /// The naive reading -- an error result like any other -- is what shipped
+    /// before this: the transcript said "Claude AI usage limit reached|…" in
+    /// red, which is neither readable nor actionable, and nothing above the
+    /// driver could tell it apart from a broken tool call.
+    #[test]
+    fn a_turn_stopped_by_the_usage_limit_says_so_and_carries_the_reset() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let mut translator = Translator::new(dir.path().to_path_buf());
+        let events = translate_lines(
+            &mut translator,
+            &[
+                r#"{"type":"result","subtype":"error_during_execution","is_error":true,"result":"Claude AI usage limit reached|1788546972","usage":{}}"#,
+            ],
+        );
+        assert_eq!(
+            events[0],
+            Event::LimitReached {
+                resets_at: Some(1_788_546_972.0)
+            }
+        );
+    }
+
+    #[test]
+    fn a_limit_the_cli_gave_no_reset_for_is_reported_without_one() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let mut translator = Translator::new(dir.path().to_path_buf());
+        let events = translate_lines(
+            &mut translator,
+            &[
+                r#"{"type":"result","subtype":"error_during_execution","is_error":true,"result":"Claude AI usage limit reached","usage":{}}"#,
+            ],
+        );
+        // Not a time this side invented: the meter is asked before anything is
+        // sent, and a made-up reset would only decide when to ask.
+        assert_eq!(events[0], Event::LimitReached { resets_at: None });
+    }
+
+    #[test]
+    fn a_reset_in_milliseconds_is_not_read_as_the_year_58000() {
+        assert_eq!(
+            usage_limit("Claude AI usage limit reached|1788546972000"),
+            Some(Some(1_788_546_972.0))
+        );
+        // And anything that is not the limit stays an ordinary failure.
+        assert_eq!(usage_limit("something broke"), None);
+    }
+
     /// Pressing Stop is not a failure, and the CLI cannot tell you which it was.
     ///
     /// An interrupted turn arrives as exactly the same shape a broken one does,