Add explicit confirmation before consuming rate-limit resets

[ClaudiuSchuster]

Closes #33

What changed

• Makes the available earned reset row and count actionable in the popup only
  when the authoritative count is positive.
• Adds a native confirmation dialog with the available count and known expiry;
  Cancel, Escape and closing the dialog never consume a credit. The safer
  default button is Cancel, and the dialog now uses the concise limit reset
  wording.
• Adds a separate local Codex app-server consume request with one UUID
  idempotency key per attempt and the selected opaque credit ID when detail
  rows are available. Count-only snapshots remain supported without a credit
  ID.
• Disables duplicate actions, handles every documented terminal outcome,
  refreshes the complete usage snapshot after a response and shows concise
  feedback in the popup.
• Adds native hover tooltips to every 5h and 7d reset-countdown circle, with
  the elapsed percentage and remaining time for that circle's own window.
• Restores the muted Credits: treatment for Limit resets:, its separator,
  expiry text and countdown while keeping the reset count bright; the
  separator is slightly smaller and vertically aligned.
• Refreshes the four popup README captures with sparse, privacy-safe demo
  activity and adds the tightly cropped native confirmation screenshot.
• Updates the documentation, changelog and applet metadata to 0.3.8.

Security and privacy impact

• Normal refreshes remain read-only. A reset is consumed only after the user
  explicitly activates the destructive confirmation action; there is no
  background redemption, private HTTP endpoint, API-key access or credential
  file access.
• The existing Codex CLI/app-server remains responsible for authentication and
  networking. The local history format is unchanged and stores no reset-credit
  details or credentials.
• README screenshots use synthetic demo values, hide the live desktop context
  and contain no account-specific data, tokens or private paths.

Verification

• make verify (including make check) passes.
• Behavior-specific JavaScript and Python coverage covers reset-countdown
  tooltip formatting, count-only data, earliest-expiry selection, zero-count
  inactivity, optional creditId, the required idempotency key and all
  documented outcomes.
• Pinned Super-Linter 8.7.0 passes on this head.
• The regular install plus targeted applet reload passed with
  EXPECTED=10 VALID=10 SYMLINKS=0 MISMATCHES=0; Cinnamon stayed on the same
  PID and the live applet reported version 0.3.8 with no error or busy state.
• Live Cinnamon QA confirmed the 5h and 7d native reset-ring tooltips,
  the muted reset row styling, the smaller/lower separator and the updated
  confirmation title without consuming a reset.
• README image dimensions, 8 px modal padding and the four refreshed
  popup crops were visually audited after cleanup restored the original
  desktop, desklet, menu and pointer state.