Update Usage Limits to 2.0.0

[Norbert515]

Summary

• replace the combined Usage Limits dashboard with independent 420 px Claude and Codex cards matching the locally developed extension;
• show receipt timestamps in the owner’s current local offset and replace stale values with a fixed-sheen loading skeleton while refreshes are in flight;
• switch collection from a Codex child process plus Claude external action to host-brokered Anthropic and ChatGPT connector reads;
• publish this as 2.0.0 because the persisted usage.dashboard surface is replaced; existing 1.0 tiles must be recreated after update.

The generated publication will require Campus 1.91.0, the first release containing the receipt clock and intermediate refresh-snapshot host behavior.

Authority review

• No authority increase
• Authority increase is intentional and documented
• Raw secret plus filesystem/HTTP/process/native exfiltration risk is called out

The guest adds connector.http.request, but removes the scoped codex process resource and the Claude external action. It retains only shared-state and scene writes. There is no filesystem, process, native, task, external-action, or arbitrary-origin authority.

• anthropic: exact https://api.anthropic.com origin, GET only, /api/oauth/usage path prefix, 256 KiB response cap, 20 s timeout.
• openai: exact https://chatgpt.com origin, GET only, /backend-api/wham/usage path prefix, 256 KiB response cap, 20 s timeout.

Path-prefix authority includes descendants and bounded query parameters; the shipped guest calls only the named paths without queries. Campus injects the existing local bearer credential inside the host broker, so guest JavaScript never receives a raw secret. Only bounded display projections enter shared state, and both refresh actions remain owner-only.

Verification

• python3 -m unittest discover -s tool/tests -v
• node --test extensions/*/test/*.test.mjs
• python3 tool/registry.py validate --root .
• README and CHANGELOG updated
• No credentials, user data, downloaded dependencies, or install hooks added
• Trusted publication simulation produced sha256:aa00700f903477c875a8e2ce39d4a8c95339f9232cd55ef82ab8eac230b95649 and a catalog/artifact-only diff