fix(cookie): order-independent parsing, reject fake auth, preserve locale

[waknow]

Summary

normalizeCookie in src/config.ts had a parsing bug that corrupted valid
browser cookies and made the plugin report a misleading http302.

The old code decided "the first ;-segment is the auth value" whenever the
string did not start with auth=. A real cookie pasted from a browser often
looks like this (especially under a non-English locale):

oc_locale=zh; desktop_promo_dismissed=1; auth=Fe26.2*...

Because it does not start with auth=, the old code treated oc_locale=zh
as the auth token and persisted a fake cookie: auth=oc_locale=zh; ....
opencode.ai rejects that, redirects to the login page, and the plugin reports
http302 ("usage page parsed empty"). This bug is independent of locale — any
cookie whose auth segment is not first is corrupted.

Fix

Rework normalizeCookie to be safe and order-independent:

• Locate auth= anywhere in the string instead of assuming it is first
  (a bare opaque token with no = still gets auth= prefixed).
• Refuse to persist a broken cookie: if no real auth token is present,
  return undefined so writeConfigFile never writes auth=<locale>.
• Preserve the pasted oc_locale (zh stays zh), falling back to en
  when absent or malformed — the parser already understands Chinese pages
  (merged via PR fix(api): parse zh-locale usage labels and reset phrases #2), so both English and Chinese consoles parse correctly.
• Accept both ; and , separators (Cookie-header / Set-Cookie style) and
  drop unrelated UI segments (e.g. desktop_promo_dismissed).

Changes

• src/config.ts — rewrite normalizeCookie
• src/config.test.ts — new regression tests + updated expectations
• lib/... — rebuilt artifacts so the fix takes effect via main/types
• COOKIE-FIX.md — rationale, root cause and sync notes
• .gitignore — ignore lib/tsconfig.tsbuildinfo (build cache)

Verification

• pnpm test — 53/53 passed (config: 19, api: 23, service: 7, provider: 4)
• pnpm typecheck — clean
• Live check with a real cookie: same URL+cookie that previously 302'd now
  returns usage data (no redirect).

Notes

Rebased onto the latest main (including the already-merged zh-locale parsing
in PR #2). Single, focused commit; no localization work is added here.