feat: add Muse coding-plan provider

[yesme]

Track Meta Muse coding-plan quotas (5h prompts + weekly) from the same subscription snapshot muse /usage shows.

Why this shape

Meta publishes no aggregate usage endpoint for the coding plan (probed /v1/usage, /v1/billing, org usage/costs - all 404). Each poll sends one minimal streamed probe (POST /v1/responses with stream: true, input ping, max_output_tokens: 16) and extracts the inline subscription object. Verified against the live API:

{"subscription": {"tier": "pro",
  "weekly": {"resets_at": "1789344000", "used_percent": "12.5"},
  "window": {"resets_at": "1789078632", "used_percent": "34", "window_duration_mins": "300"}}}

Auth

Resolves as META_API_KEY -> providers.meta.api_key in the muse login file -> macOS Keychain / Linux keyring entry written by muse login. The Keychain lookup is deadline-bounded (15s + regression test) so an unanswered approval dialog can never block daemon startup.

Includes

• API client + types (string-or-number scalars, epoch s/ms, last-snapshot-wins SSE scan)
• Credential auto-detect (unix keychain/keyring, windows file) + probe-model resolution
• SQLite store (snapshots, quota values, reset cycles) + reset-cycle tracker + polling agent + daemon wiring
• 7 web endpoints, dashboard cards, menubar card, settings form, setup wizard, install.sh/ps1, docs/MUSE_SETUP.md, landing card

Verified

• ./app.sh --smoke green on this branch; tests/test_install.sh 27/27 (incl. 2 new Muse cases)
• End-to-end against the live API (daemon poll, store, cycles, all endpoints, dashboard tab, menubar)
• One pre-existing failure, unrelated: tools/perf-monitor TestMain_RestartFailureExitsWithError hangs in this dev environment because the test helper starts a real onwatch (found via PATH) and blocks forever on its output pipe. It fails identically with and without a repo-local binary, and involves no code touched by this PR.

[codecov]

Codecov Report

❌ Patch coverage is 48.79747% with 809 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/web/muse_handlers.go	33.65%	256 Missing and 16 partials ⚠️
internal/store/muse_store.go	47.32%	160 Missing and 27 partials ⚠️
internal/tracker/muse_tracker.go	58.59%	47 Missing and 18 partials ⚠️
internal/web/handlers.go	14.89%	36 Missing and 4 partials ⚠️
internal/agent/muse_agent.go	51.28%	34 Missing and 4 partials ⚠️
internal/api/muse_client.go	71.87%	31 Missing and 5 partials ⚠️
internal/api/muse_credentials.go	50.68%	25 Missing and 11 partials ⚠️
main.go	18.60%	25 Missing and 10 partials ⚠️
internal/api/muse_token_unix.go	0.00%	33 Missing ⚠️
internal/api/muse_types.go	80.14%	15 Missing and 12 partials ⚠️
... and 3 more

📢 Thoughts on this report? Let us know!

[yesme]

Follow-up fix on this branch: b32ea7b

Cause: the usage probe was a full streamed POST /v1/responses on the same Meta API key as the live Muse TUI. Holding that generation until ping finished 429'd the CLI (reason="rate_limited" in muse traces) and looked like Muse/onWatch crashing. Separately, unsigned Darwin pages can be SIGKILL'd by taskgated.

What changed:

• Close the SSE stream as soon as the subscription snapshot arrives
• Skip the probe while a muse process is running
• Treat HTTP 429 as a skipped cycle
• Ad-hoc codesign Darwin production builds

[prakersh]

Thanks for this, it is a clean provider addition. It follows the existing per-provider layout, and everything passes on our side: go vet, go test -race across api, agent, store, tracker and web, 27/27 in tests/test_install.sh, and it rebases onto main with no conflicts.

We are keeping the 120s default polling as is. The 5h window is token metered, so a 16 token probe is noise, and we would rather have one polling model across all providers.

Two things before we merge:

1. The live-CLI guard uses pgrep, which does not exist on Windows, so LookPath fails and the probe never skips there. We already solve this in internal/agent/anthropic_cc_detect.go (IsClaudeCodeRunning): ps -Ao args= on unix, tasklist on Windows. Could you lift that into a small shared helper and have Muse use it? Dropping the skip entirely and relying on the early stream close is also fine by us.

2. isProviderConfigured("muse") calls DetectMuseCredentials on every provider-list request, so each one shells out to security or secret-tool with a 15s deadline. Please resolve it once at startup, or memoize it.

Optional: a MUSE_BASE_URL override would match ZAI_BASE_URL for proxy setups.