fix: suppress keychain prompts in background

[s0up4200]

Summary

• Claude: avoid background Keychain prompts during OAuth refresh; refresh cached credentials after file/keychain changes.
• Claude OAuth can still prompt on manual/CLI fetch when creds only exist in Keychain.
• Codex: skip keychain-backed browser cookie imports during background refresh; only prompt on manual refresh/import.
• Keychain cache reads and writes are non-interactive to avoid "CodexBar Cache" prompts.
• Tests: add coverage for no-prompt browser filtering.

Notice

• This PR was written with Codex.
• I have run this for a while now and no longer see prompts for CodexBar Cache, Claude or Codex. Several restarts etc. Would like more people to test.

Related

• Builds on fix(claude): reduce keychain prompts even after granting Always Allow #245 (unmerged): carries forward the no-prompt keychain approach and extends it to Codex background refresh.

User impact

• No more random Keychain prompts during background refresh.
• Prompts only appear when users explicitly refresh or sign in.
• Safer cookie import behavior in the background (Safari/Firefox still eligible; Chromium deferred until user action).

Files touched

• Sources/CodexBarCore/Providers/ProviderFetchPlan.swift
• Sources/CodexBarCore/Providers/Claude/ClaudeUsageFetcher.swift
• Sources/CodexBarCore/Providers/Claude/ClaudeProviderDescriptor.swift
• Sources/CodexBarCore/KeychainCacheStore.swift
• Sources/CodexBarCore/Providers/Claude/ClaudeOAuth/ClaudeOAuthCredentials.swift
• Sources/CodexBar/KeychainMigration.swift
• Sources/CodexBar/UsageStore+Refresh.swift
• Sources/CodexBar/UsageStore.swift
• Sources/CodexBar/ProviderRegistry.swift
• Sources/CodexBar/PreferencesProvidersPane.swift
• Sources/CodexBarCLI/CLIUsageCommand.swift
• Sources/CodexBarCore/KeychainAccessPreflight.swift
• Sources/CodexBarCore/Providers/Claude/ClaudeUsageFetcher.swift
• Sources/CodexBarCore/OpenAIWeb/OpenAIDashboardBrowserCookieImporter.swift
• Sources/CodexBarCore/BrowserCookieImportOrder.swift
• Tests/CodexBarTests/ClaudeOAuthCredentialsStoreTests.swift
• Tests/CodexBarTests/KeychainMigrationTests.swift
• Tests/CodexBarTests/BrowserDetectionTests.swift
• CHANGELOG.md

Testing

• ./Scripts/compile_and_run.sh
• pnpm check (fails due to pre-existing SwiftFormat debt; 69/399 files require formatting, node_modules missing)

Fixes #219, #243

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fe512533d0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".