Win-CodexBar 0.48.0 aflaai

Windows port of upstream CodexBar **0.47.0 → 0.48.0**.

### Added
- Providers: CodeBuddy CN credit usage (#269).
- Codex: multi-account management — Codex accounts panel in provider settings and tray menu flyout for switching accounts (#255–#260).
- Serve: modular usage dashboard (coordinator/snapshot structure with provider icons) from upstream 0.48.0 (#271).
- Sessions: unified Pi-family (pi + OMP) agent sessions with live-process correlation, PID-only rows, and a unified AgentSessions view; `sessions --json-v2` with legacy `--json` fallback negotiated over SSH (#271).
- Upstream 0.48.0: Copilot AI credits counter, CommandCode rolling windows + GOAT plan, OpenRouter key meter, ZoomMate browser cookie scope, OpenCode Go per-model daily cost breakdown (#271).
- Regional: Kimi Desktop monthly membership enrichment, GLM Coding Plan 5-hour/weekly windows, z.ai Global vs BigModel CN region routing with cross-region endpoint override rejection (#271).

### Fixed
- Codex weekly window detection when the 5-hour session window is missing (#268).
- MiniMax CN Token Plan web fetch via token-plan endpoints (#254, #262).
- Tray: auto-fit measure scaled by active zoom + proof anchor clamp (#265, #266).
- Tray: Codex accounts card overflow and weekly-only tray bar (#264).
- Tray: fractional-DPI flyout resize oscillation via two-state cycle detection (#261, #272).
- Upstream 0.48.0: bounded serve request heads, bounded Codex JSONL cost cache (oversize persistence refused), Claude OAuth terminal/transient refresh classification, Codex reset backfill (#271).

### Changed
- Upstream 0.48.0 provider and CLI behavior ported onto the Windows tray/desktop shell (#271).
- Repo automation: contributor interaction guard relaxed to a 14-day account-age floor and 15 PRs per 7-day window (#263).
- Docs: SignPath code-signing policy and privacy statement published; code signing is pending SignPath onboarding — release artifacts remain unsigned with SHA-256 sidecars (#270).