feat: Add per-account usage caching, session affinity, and account email widget

[carterross]

Summary

Adds multi-account support so each Claude Code session displays the correct usage stats and account email, even when multiple sessions are logged into different accounts simultaneously.

• Per-token cache files (usage-{hash}.json, profile-{hash}.json) instead of a single global cache, preventing cross-account data bleed
• Session affinity pins each session to its starting account's token hash; smart conflict resolution detects in-session /login vs cross-session account switches
• Shared OAuth credential module (credentials.ts) with macOS keychain discovery for Claude Code v2.x suffixed entries
• New account-email widget showing the current account's email address via /api/oauth/profile with 24-hour caching

Motivation

When switching between multiple Anthropic accounts (e.g. personal and work), the status line would show whichever account's data was fetched last — even in sessions logged into a different account. This made usage stats unreliable for users with multiple accounts.

Changes

File	What changed
credentials.ts (new)	Shared OAuth token retrieval with macOS keychain scanning for suffixed entries
session-affinity.ts (new)	Session-to-account pinning with smart /login detection
profile-fetch.ts (new)	Profile API client with per-token file caching (24h TTL)
profile-prefetch.ts (new)	Conditional prefetch for profile-dependent widgets
AccountEmail.ts (new)	New widget displaying account email
usage-fetch.ts	Per-token cache/lock files, session account support, deduplicated token hashing
usage-prefetch.ts	Thread session account to usage fetcher
ccstatusline.ts	Resolve session account, wire profile data through render context
RenderContext.ts	Added profileData field
widget-manifest.ts	Register account-email widget
widgets/index.ts	Export AccountEmailWidget
usage-fetch.test.ts	Updated mocks for per-token cache paths and keychain discovery

Test plan

• All 527 existing tests pass
• Configure account-email widget and verify email displays
• Log into Account A in session 1, Account B in session 2 — verify each shows correct usage/email
• Use /login within a session — verify it updates to the new account
• Verify non-macOS credential file path still works

🤖 Generated with Claude Code