feat: responsive refresh, multi-limit menu bar, graphical settings and privacy mode

[StevenACZ]

Summary

• Faster first value. TokenGauge watches ~/.claude.json, $CODEX_HOME/auth.json and the status-line capture, so sign-in and account switches refresh within seconds. Claude quota is published before the local activity scan finishes, and the app refreshes after wake.
• No more -- from rate limits. The Claude usage endpoint is called on a budget (270 s, or 60 s when forced) with backoff after HTTP 429. A ready reading up to 15 minutes old stays visible. Between reads, newer status-line captures for the same account can raise a window's usage.
• Multi-limit menu bar. Any combination of Claude's 5-hour, weekly and model weekly limits can appear together, as labelled numbers, concentric rings or stacked bars. The old single choice migrates automatically. Right-click opens a quick menu for these limits, the indicator style, privacy mode and refresh.
• Graphical Settings. A wider, two-column window led by a live menu bar preview that renders the real indicator. Click provider and limit chips to choose what the menu bar shows, pick the style from previews, set the size with a slider, and watch a short demo of the right-click menu.
• Codex limits and provider visibility. Codex windows can be chosen for the menu bar too, and either provider can be hidden (at least one always stays). The right-click menu has a section per provider.
• Panel settings menu fix. The gear menu in the panel no longer closes itself on the first click. The app now activates when the panel opens and returns focus to the previous app when it closes. While that menu is open, a status item click only dismisses the menu, and stray outside clicks no longer close the panel.
• Switching tabs keeps the panel open. On macOS 27 the menu bar item is hosted outside the app, and changing it while the panel is open closed the panel mid-click and left the item unresponsive for about 5 seconds. The item now updates when the panel closes.
• Solid panel background. The panel no longer uses see-through glass, so it stays readable over dark wallpapers. The background also covers the arrow.
• Wider single-provider rings. In the Rings style, a single provider with three limits shows its rings side by side, as in the Unified view.
• Privacy mode hides the account email in the panel.
• Smoother updates. A manual refresh requested during a running refresh is queued instead of dropped, and percentages animate when they change (honoring Reduce Motion).
• Memory. The first history scan drains its read buffers; the cold-scan peak fell from about 2 GB to about 113 MB.
• Build fix. With Xcode 27, Swift Build recorded the deployment target as the linked SDK version. macOS then ran the app in legacy mode, and SwiftUI opened an empty Settings window at launch. Packaging now passes -isysroot to the linker and fails if any executable's SDK differs from the toolchain SDK.

Testing

• make ci-check: 248 tests, 0 failures, lint clean
• New tests: ResponsiveRefreshTests, FileChangeMonitorTests, MenuBarMultiWindowTests, plus the privacy header render
• Manual QA on a second Mac with real accounts:
  • quota within 1.2 s (Claude) and 2.3 s (Codex) after launch
  • right-click menu and left-click popover
  • three Claude limits in numbers, rings and bars
  • privacy mode persisted across relaunch
  • idle CPU 0.0% average
  • no window at launch in 3 of 3 runs after the build fix
  • Settings chips, style tiles and size slider update the real menu bar within 0.2 s; the demo leaves nothing on screen
  • gear menu stays open on the first click, including after cycles over other apps; no ignored clicks after closing with the menu open; focus returns to the previous app; Esc closes the panel
  • switching Codex, Claude and Unified keeps the panel open; the menu bar item updates after closing, whether by status item or outside click; right-click menu and Settings still update it immediately
  • solid background in dark and light, nothing clipped; three Claude rings in one row