fix: Recognize 403 permission errors + honest no-data placeholder

Two follow-ups observed in real-world use:

- 403 from the usage endpoint is now a typed error. It occurs when the
  account has no active Pro/Max subscription (e.g. the plan lapsed):
  {"error":{"type":"permission_error","message":"OAuth authentication
  is currently not allowed for this organization."}}. Previously this
  fell into the generic catch and surfaced as the raw
  'The operation couldn't be completed. (UsageError error 0.)' text.
  Now the card shows 'No active subscription on this account'.

- The account card's fallback branch (no usage sample AND no error
  state) displayed a hardcoded 'Token expired. Switch to this account
  in Claude Code to refresh.' - making perfectly healthy accounts look
  broken whenever they simply had not been sampled yet. With round-robin
  polling this waiting state is visible for a few minutes after launch,
  so it now shows an hourglass and 'Waiting for usage data...'.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>