ai: restore the quota probe on Codex, rewrite the footer

The Codex migration left /usage returning 501 and no quota signal for the
governor. Codex does expose one after all — it just isn't an HTTP endpoint.

Probe: `codex app-server` is a JSON-RPC-over-stdio surface whose
`account/rateLimits/read` returns the same snapshot the interactive TUI
shows. Handshake is initialize -> `initialized` NOTIFICATION -> read; without
the notification the read never answers. adolf-llm's /usage now drives that
and normalises the result.

Shape change, and why the consumers had to be rewritten rather than repointed:
Kimi reported fixed buckets (window_5h / weekly / window_7d). Codex reports up
to two plan-defined windows, `primary` (long) and `secondary` (shorter burst,
often null), so the payload is now {plan, pct, primary, secondary,
limit_reached} with each row as {pct, window_mins, window_label, resets}. `pct`
is the max across live windows — the single number a gate can read without
knowing which window binds.

Probing spawns a codex process (~2s), so results are cached in memory and on
the workspace volume with a 5min TTL, concurrent probes are de-duped, and a
failed refresh serves the last good reading tagged stale/as_of/age_s rather
than nothing. ?force=1 bypasses the TTL.

kimi-quota-footer-plugin -> codex-quota-footer-plugin (id, mount path and the
openclaw.json entry key all renamed together — they must agree or the plugin
silently fails to load). It now renders whatever windows the plan actually
has, shortest first, and flags limit_reached and stale readings. quota-command
updated for the same payload.

Verified: /usage returns live data (30d 4%, plan free), warm cache serves in
17ms vs ~2s cold, the gateway reaches the route, adolf loads
codex-quota-footer, and the formatter degrades to no footer on empty/null
payloads instead of breaking the reply.

Note: the account reports planType "free", not a paid ChatGPT plan.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014Y5QPagv4iun1ghpwM96Ff

ai/codex-quota-footer-plugin/openclaw.plugin.json

@@ -0,0 +1,42 @@
+{
+  "id": "codex-quota-footer",
+  "name": "Codex Quota Footer",
+  "description": "Appends a compact Codex usage line (the plan's own rate-limit windows, e.g. 5h/30d %) to the end of each of Adolf's outgoing replies, via the reply_payload_sending hook. Reads the LLM-free adolf-llm:8010/usage route, which drives `codex app-server`'s account/rateLimits/read; cached + background-refreshed so it never blocks the send path.",
+  "activation": {
+    "onStartup": true
+  },
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+      "enabled": { "type": "boolean" },
+      "usageUrl": { "type": "string" },
+      "cacheTtlMs": { "type": "integer", "minimum": 1000, "maximum": 3600000 },
+      "fetchTimeoutMs": { "type": "integer", "minimum": 200, "maximum": 30000 },
+      "prefix": { "type": "string" },
+      "showPlan": { "type": "boolean" }
+    }
+  },
+  "uiHints": {
+    "enabled": {
+      "label": "Codex Quota Footer",
+      "help": "Append a compact Codex usage line to the end of each reply."
+    },
+    "usageUrl": {
+      "label": "Usage URL",
+      "help": "adolf-llm /usage endpoint (default http://adolf-llm:8010/usage)."
+    },
+    "cacheTtlMs": {
+      "label": "Cache TTL (ms)",
+      "help": "How long a fetched usage snapshot is reused before a background refresh (default 60000)."
+    },
+    "prefix": {
+      "label": "Footer Prefix",
+      "help": "Text before the percentages (default \"— Codex:\")."
+    },
+    "showPlan": {
+      "label": "Show Plan Name",
+      "help": "Also show the ChatGPT plan the limits belong to (e.g. \"free\"). Off by default."
+    }
+  }
+}