Restore account recovery and quota clarity for v1.0.8

[squarepots]

Product changes

• Make quota failures visible on the affected card with a compact warning, a safe reason, and the last successful update. Mark cached percentages as previous results.
• Restore saved-account sign-in through the official Codex OAuth flow. The authorization link is copyable and opens only when selected; a repeated login must match the saved user, workspace, and available email.
• Show the provider-supplied Free-plan five-week Codex window and reset time instead of empty five-hour and weekly placeholders.
• Check Codex file-store policy in a GSwitch-owned isolated profile before switching, and distinguish configuration, current-credential, and saved-account failures. Keep process checks, identity checks, rollback, and pending recovery.
• Add Copy email to account menus, simplify language settings, and use direct five-hour/weekly Wake messages only for fresh zero quota.
• Synchronize Tauri, JavaScript, and Cargo at 1.0.8; update the canonical workflow, security, and design documents.

Validation

• pnpm test -- --run --reporter=dot — 62 passed.
• pnpm build and pnpm version:check — passed.
• cargo test --lib --quiet — 124 passed, 1 ignored; the new re-login identity regression test passed separately.
• Installed Codex App Server isolated-profile config test — passed.
• git diff --cached --check — passed before commit.

No real saved account was switched, signed in, refreshed, or woken during development. Maintainer acceptance of those flows remains on the published Windows build.

Refs #119, #120, #123. #110 remains the ongoing Renovate dashboard.