#389 feat(vault): read Claude quota from insula; adopt common-auth 0.19.1

Vault mode reads Claude quota from insula, the fleet's quota monitor, instead of every plugin polling Anthropic's usage endpoint itself, and adopts @cortexkit/common-auth@0.19.1 (gitHead 271bc3da, integrity matching the signed-off candidate), which makes insula's consumer-free reader public.

• Vault mode only. Enrollment authority is read fresh on each background tick; local mode, or a missing or unreadable enrollment token, never touches insula.
• Background tick: acquireInsulaQuotaSource (shared per connection file and enrollment token, one refresh a minute), then current('claude', accountId) per vault account, joined by the vault's account_id only. A current reading is published bound to the served credential version and our own usage poll is skipped for that account; anything else (missing, stale, errorClass, over four minutes, or a credential for a different account) falls back to our poll for that account immediately.
• Request path: reads insula's cache only, never refreshes it, then our one-shot poll on a miss.
• Mapping: five-hour and seven-day windows from primary/secondary, model-scoped weeklies (Fable) from extraRateWindows by id, usedPercent as is, and every window's reading time is insula's fetchedAt. A newer window on disk is never overwritten by an older insula one.
• One info log line when an account's source switches between insula and our poll, with a fixed reason code and no identity.
• The source is released when the vault runtime closes.

Mutation rows guard the account join, the poll skip and the release.

---

Summary by cubic

Vault mode reads Claude quota from insula, the fleet's quota monitor, instead of every plugin polling Anthropic's usage endpoint itself, and adopts @cortexkit/common-auth@0.19.1, which exposes the consumer-free insula reader. Local mode, or a missing or unreadable enrollment token, never touches insula.

• Background sweeps refresh insula's cache (shared per connection file and enrollment token, once a minute) and use a current reading per account, skipping that account's usage GET; a missing, stale, failed, or foreign-account reading falls back to polling immediately.
• Request-path (admission) lookups read insula's cache only, never refresh it, and poll on a miss.
• Insula entries are mapped to the existing snapshot shape: five-hour and seven-day windows, model-scoped weeklies (such as Fable) from extraRateWindows, and the Extra usage pool; a newer stored window is never overwritten by an older insula one.
• Source switches are logged once per change with a fixed reason code and no identity, and the insula source is released when the vault runtime closes.
• Sidebar state writes now look up their test hooks at rename time, so a test that starts listening mid-write still hears the rename instead of timing out.