ai: restore the quota probe on Codex, rewrite the footer

The Codex migration left /usage returning 501 and no quota signal for the
governor. Codex does expose one after all — it just isn't an HTTP endpoint.

Probe: `codex app-server` is a JSON-RPC-over-stdio surface whose
`account/rateLimits/read` returns the same snapshot the interactive TUI
shows. Handshake is initialize -> `initialized` NOTIFICATION -> read; without
the notification the read never answers. adolf-llm's /usage now drives that
and normalises the result.

Shape change, and why the consumers had to be rewritten rather than repointed:
Kimi reported fixed buckets (window_5h / weekly / window_7d). Codex reports up
to two plan-defined windows, `primary` (long) and `secondary` (shorter burst,
often null), so the payload is now {plan, pct, primary, secondary,
limit_reached} with each row as {pct, window_mins, window_label, resets}. `pct`
is the max across live windows — the single number a gate can read without
knowing which window binds.

Probing spawns a codex process (~2s), so results are cached in memory and on
the workspace volume with a 5min TTL, concurrent probes are de-duped, and a
failed refresh serves the last good reading tagged stale/as_of/age_s rather
than nothing. ?force=1 bypasses the TTL.

kimi-quota-footer-plugin -> codex-quota-footer-plugin (id, mount path and the
openclaw.json entry key all renamed together — they must agree or the plugin
silently fails to load). It now renders whatever windows the plan actually
has, shortest first, and flags limit_reached and stale readings. quota-command
updated for the same payload.

Verified: /usage returns live data (30d 4%, plan free), warm cache serves in
17ms vs ~2s cold, the gateway reaches the route, adolf loads
codex-quota-footer, and the formatter degrades to no footer on empty/null
payloads instead of breaking the reply.

Note: the account reports planType "free", not a paid ChatGPT plan.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014Y5QPagv4iun1ghpwM96Ff

ai/docker-compose.yml

@@ -373,11 +373,13 @@ services:
       # Cognee as Adolf's memory backend. Activated via
       # plugins.entries.hindsight-memory in openclaw.json.
       - ./hindsight-openclaw-plugin:/home/node/.openclaw/extensions/hindsight-memory:ro
-      # kimi-quota-footer plugin (kb #85) — same pattern. Appends the Kimi
+      # codex-quota-footer plugin (kb #85) — same pattern. Appends the Codex
       # usage line to every outgoing reply via reply_payload_sending, reusing
       # quota-command's adolf-llm:8010/usage route. Activated via
-      # plugins.entries.kimi-quota-footer in openclaw.json.
-      - ./kimi-quota-footer-plugin:/home/node/.openclaw/extensions/kimi-quota-footer:ro
+      # plugins.entries.codex-quota-footer in openclaw.json (the mount path,
+      # the plugin's own id and that entry key must all agree or the plugin
+      # silently does not load). Renamed from kimi-quota-footer 2026-08-01.
+      - ./codex-quota-footer-plugin:/home/node/.openclaw/extensions/codex-quota-footer:ro
       # todoist-capture plugin (kb#170 component 1) — same pattern.
       # Registers /idea (native command, zero Kimi calls); POSTs to
       # agap-mcp's /capture-idea (see agap-mcp/src/server.js + capture.js)