Disable OAuth API fallback for subscription usage

[zhnd]

Summary

• Gate the OAuth API fallback path in SubscriptionUsageService::fetch_usage behind a new ENABLE_API_FALLBACK constant (off by default), so the Usage page sources data exclusively from the CLI probe (claude /usage).
• No Keychain access on the usage path now — matches ClaudeBar's default behavior.
• API helpers (fetch_via_api, refresh_token, call_usage_api, OAuth constants, response structs) are retained but unreached at runtime; flip the flag to true to restore CLI-then-API behavior.
• On CLI probe failure, return a SubscriptionUsageResult with an error message instead of falling through to the API. Frontend already renders this as the existing error state — no UI changes needed.

Test plan

• cargo check -p app passes with no dead-code warnings
• pnpm tauri:dev launches and /usage page loads quota buckets via the CLI path
• Logs show CLI probe only; no requests to api.anthropic.com and no Keychain prompt
• CLI failure path renders the error state in the UI (not a login prompt)
• Refresh button re-invokes the CLI probe
• API-billing accounts still render the api_billing empty state via subscriptionType === "API"