feat: configurable provider credentials and DMS controls

[SyahrulBhudiF]

Problem

PakAI previously hard-coded the credential source for Codex and OpenCode Go. Codex required Pi's OAuth entry, while OpenCode Go required Pi's API key. Users running the Codex CLI or OpenCode directly could not select their own credentials. The DMS compact indicator also showed the highest percentage across every enabled provider, so one exhausted window could make the panel display 100% even when that was not the provider the user intended to monitor.

Changes

Credential sources

• Codex supports two persisted sources:
  • Pi: ~/.pi/agent/auth.json → openai-codex OAuth.
  • Codex CLI: ~/.codex/auth.json OAuth.
• OpenCode Go supports two persisted sources:
  • Pi: ~/.pi/agent/auth.json → opencode-go API key.
  • OpenCode: ~/.local/share/opencode/auth.json → opencode API key.
• The selected source is stored in provider.<id>.source; switching it rebuilds daemon providers immediately.
• Provider detection checks both Pi and native Codex/OpenCode credential files.

DMS provider settings

• Settings now show selectable source chips: Pi / Codex CLI for Codex and Pi / OpenCode for OpenCode Go.
• Every provider has an enable/disable toggle.
• Show selects one provider for the compact panel indicator. It does not disable or hide other providers.
• The compact panel no longer takes the worst percentage across all providers when no provider is selected.
• Add a visible ← Back button from provider settings.

OpenCode Go usage

• Replace dashboard cookie scraping with GET https://opencode.ai/zen/go/v1/usage.
• Authenticate with the selected API key using Authorization: Bearer <key>.
• Surface the API's 5-hour, weekly, and monthly quota windows.

DMS install reliability

• pakai setup dms --install follows chained destination symlinks, so it can update a symlinked DMS plugin directory.

Screenshot

The DMS provider settings view shows source choices, Show for the compact-panel provider, and enable/disable toggles.

Verification

• go test ./...
• go vet ./...
• Verified the OpenCode source selection against the native OpenCode credential file, then restored OpenCode Go to Pi.