fix: Stop spawning claude CLI on every refresh (macOS Tahoe TCC prompts)

Every 5-min refresh was spawning `claude --version` (via
isClaudeAvailable) and `claude auth status` (via getAuthStatus). On
macOS Tahoe (with the macos-26 SDK we recently switched CI to),
launching `claude` from `~/.claude/local/...` triggers App Management
TCC and shows the "would like to access data from other apps" prompt.

Three changes that together remove all periodic CLI spawns:

- Add ClaudeService.isClaudeAvailableQuick(): file-existence check at
  the resolved claudePath, no Process spawn. Used by the periodic
  refresh path; the spawning isClaudeAvailable() is reserved for
  user-initiated flows that need the CLI's full validation.

- Add ClaudeService.getAuthStatusLocal(): builds AuthStatus from the
  keychain token + ~/.claude.json oauthAccount block (already what
  the rest of the app reads anyway). Periodic refresh switches to
  this; login/switch/reauthenticate still use the CLI variant.

- Rate-limit the delegated-refresh path in fetchAllAccountUsage to
  one CLI spawn per 30 min per account. Token expiry is ~5h so a
  healthy account still recovers before the next expiry; an actually
  dead account no longer pings the user every 5 min.