Improve startup animations, slash-command menus and quota accounting - #82

The terminal and browser previously opened directly into their dashboards. Startup now randomly chooses one of three full-width CODEXOMETER entrances, then shrinks the completed wordmark into the header before revealing the dashboard. The browser header also uses the terminal's block lettering, rendered as SVG so it scales independently of installed fonts.

• Slide: the logo enters from the right at the vertical centre.
• Typing: a dot blinks three times, then advances as eleven letters appear in their fixed positions.
• Shuffle: eleven random letters/digits change while positions resolve in a random order; resolved characters stay fixed.

All three use the same letter slots and completed bitmap, followed by a 180 ms hold and 800 ms eased shrink/dock. Total playback is approximately 1.9 seconds for slide, 2.2 seconds for shuffle and 3.1 seconds for typing. Choice and shuffle order are retained throughout resizes, and elapsed-time progress catches up after delayed frames.

Data loading continues during the intro: terminal fetches and saved-view loading keep their handlers, while browser pairing and live snapshots start immediately. A key or left click skips, with input consumed to avoid activating hidden controls. In the terminal, q or Ctrl+C quits; inline mode and terminals smaller than 68 columns or eight rows open directly. The browser preserves modified browser shortcuts, including Shift+Tab, opens directly for reduced-motion preferences, honours a reduced-motion change during playback, and keeps the dashboard hidden and inert until the intro finishes. Navigation and stream reconnects never replay it; a fresh page load makes a new random choice. The responsive header remains a link to Quota → Bars and follows the saved theme. The browser animation sizes the SVG viewport directly at each frame and aligns its geometry with physical pixels, avoiding blurred compositor magnification of a tiny raster during entrance or docking.

The --web terminal launcher prints the complete private pairing URL as an explicit, underlined OSC 8 hyperlink, avoiding reliance on terminal URL detection. The visible text and target both include the full pairing fragment. Pipes, redirected files, non-terminal writers and TERM=dumb keep plain output. Ghostty on macOS still uses Cmd-click.

Speed commands such as /fast previously hid their choices behind a review screen, where arrows scrolled help instead of changing the speed. Both interfaces now show Standard (default) and every tier advertised for the current model in one list. Opening highlights the current speed; Up/Down moves a single bright, bold selection, while a separate CURRENT marker identifies the applied value. Enter stages the highlighted option without changing live settings, and C or the visible C CONFIRM button applies it. All model, reasoning, speed and other session-setting slash commands use this review/confirmation flow; repeated Enter never commits a change. The speed list remains visible during review; choosing another speed, cancellation or expiry invalidates its confirmation. Clicks select without applying, and the footer offers ENTER REVIEW and C CONFIRM controls. The backend uses advertised IDs, preserves model/reasoning and other sessions, and verifies the new settings before reporting success. Browser application retains bound, single-use prepare/commit tokens, with keyboard C scoped to the command panel so ordinary composer typing is preserved. Cancellation retains the draft, errors never automatically retry the write, and handled picker keys cannot trigger page navigation or copy actions. Other slash-command lists use the same selected/subdued styling.

Quota accounting previously treated every positive cumulative token increase as a completed response. Codex's synthetic context-window fill could therefore produce fake token/graph activity and restart API-equivalent learning as UNPRICED MODEL MIX, even for supported Astra/Fast usage. The reader now recognises the exact synthetic shape only with the advertised window, all explicit core token fields, zero token classes and the matching counter delta. It rebases without a response cost, observed-token increase or graph pulse, and conservatively restarts learning as LOCAL ACCOUNTING REBASED. Missing input/output data and inconsistent response/cumulative usage have separate monotonic counters and restart reasons; unavailable pricing uses UNPRICED USAGE. Per-call diagnostics retain the underlying issue. Token-count events without an explicit cumulative total are rejected before live, historical or inherited baseline handling, preventing missing/null data from being treated as a zero reset. Quota observation bracketing includes the new counters, so accounting changes cannot enter a clean sample. No model prices, tier premiums or subscription assumptions change.

Validation:

• Frontend type checking/formatting and production asset build; generated assets committed for ordinary Go builds. Twelve targeted browser startup/navigation/responsive checks pass with startup coverage at 2× device pixel ratio, including a regression that the full-size SVG paints at its displayed width. Inspected before/after Retina captures during full-size playback and docking.
• 77 Playwright tests, including model/reasoning and speed review, footer/keyboard confirmation, repeated-Enter safeguards, changed-selection cancellation, expiry and unconfirmed updates alongside all three entrances, pixel parity with the terminal source, blinking/typing/shuffle order, common full-size geometry and docking, live pairing and snapshots during playback, resize/mobile layout, skip input consumption, modified-key pass-through including Shift+Tab, reduced motion, saved themes, reload and reconnection behaviour.
• Main package and web server tests with race detection, web-server vet and a Windows application cross-build.
• Real PTY and piped-launch smoke tests verified hyperlink metadata/underline/reset, plain TERM=dumb/redirected output, successful pairing using the printed full target, and clean shutdown. Four targeted browser pairing/startup regressions also pass.
• Go core suite with race detection and coverage, go vet and Windows amd64 application/UI-test cross-builds; the locale matrix runs separately in CI. New speed regressions cover all advertised tiers/default, current-value metadata, arrow/click selection, Enter review and C confirmation, expiry/cancellation, actual highlight colours, exact tier IDs, preserving other settings/sessions, unverified writes and single-use browser tokens.
• Terminal regressions cover original lettering, bounds, variant timings, stable random frames/resolution, identical completed/docking frames, background loading, skip/quit, delayed ticks and one-time playback.
• Actual terminal previews and pseudo-terminal smoke tests observed all three variants and clean exits. Inspected browser screenshots at full size and with desktop/mobile headers. Local executable rebuilt.

Accounting regression tests cover Astra xhigh Fast, upward/downward context fills, duplicate updates, pricing after a rebase, strict rejection of partial/ambiguous records, missing/null cumulative counters in live and historical scans and both inherited-child formats, genuine unknown model/tier pricing, missing/inconsistent usage, daemon schema errors, observation bracketing and recovery after five clean quota points, including a pro_500 plan key. The final core Go suite passes with race detection and coverage; go vet and Windows application/UI-test cross-builds pass. Local executable rebuilt.