feat(claude): discover Personal and Team organizations for quota, sessions and today (#1756)

[ozymandiashh]

Summary

Closes #1756

• Discover Personal and Team organizations from Claude Desktop (Claude.app): Reads claude-code-sessions/<accountUuid>/<orgUuid>/local_*.json and oauth:tokenCacheV2 (persisting per-organization credentials and profile metadata in claude-org-credentials.json / claude-org-profiles.json so switching accounts in Claude.app keeps every subscription connected).
• Per-organization session, Today and liveSessions attribution: Maps cliSessionId from claude-code-sessions/<accountUuid>/<orgUuid>/local_*.json (and subagent sidechains) to the owning organization profile (claude-org:<orgUuid>), partitioning ~/.claude/projects/ usage accurately between Personal and each Team organization.
• macOS Keychain service for non-default CLAUDE_CONFIG_DIR: Derives Claude Code-credentials-<first 8 hex of sha256(dir.normalize("NFC"))> for non-default config directories, prefers fresher Keychain/Desktop credentials when a file credential has expired, and refreshes expired OAuth credentials when a refreshToken is present.
• Team headline window when seven_day is null: Falls back decodeClaudeUsage().primary to five_hour when seven_day is null, and updates headlineWindow to match unscoped weekly/monthly windows before falling back to the busiest window so Weekly · Fable (0%) does not mask an active 5-hour window.

Testing / Verification

• I have tested this locally against real data (not just unit tests): verified on macOS with a Personal (Max 20x) subscription and a Team (Codeburn — Team Premium) subscription; codeburn quota --claude-profiles --format json returns both Personal (Max 20x, 12 sessions today) and Codeburn (Team Premium, 7 sessions today) with their independent quota windows and exact partitioned today totals (12 + 7 = 19 sessions).
• npm test passes (tests/quota-providers.test.ts, tests/live-sessions.test.ts, tests/provider-env-declarations.test.ts, tests/env-isolation-declarations.test.ts).
• npm run build and npx tsc --noEmit succeed.
• Not a UI change.