fix: thermo-nuclear follow-ups for 0.43.0 ports

[Finesssee]

Summary

Closes thermo-nuclear FOLLOW_UP findings from merged 0.43.0 port PRs #202–#207 (skip #205 Blacksmith).

P0 / correctness

• fix: stale provider publish and cost scan freshness #207 refresh race: invalidate_provider_refresh_and_prune_disabled clears is_refreshing; superseded finish_provider_refresh returns None and skips tray / refresh-complete / enrichment.
• feat: Factory API-key Auto with web fallback #206 Factory cookie-off: SourceMode::Cli is API-only (no browser scrape). Empty dotenv no longer short-circuits a later key. Empty nested usage: {} falls through to top-level windows. Resolve API key once per Auto fetch.
• fix: stale provider publish and cost scan freshness #207 watermark: below-watermark mid-range climbs no longer re-add totals (+ regression test).

P1

• feat: add sub2api provider (upstream 0.43.0) #202 sub2api: Kind drives snapshot construction (limit-less subscription shows usage, not empty quota; balance surfaces with subscription). Plan goes to login_method only (not organization). supports_opus: false. Mode attached to login when meaningful.
• fix: scope quota notifications by account identity #203 notifications: drop unstable plan: ownership fallback.
• feat: Kimi CLI creds and Claude probe residuals (0.43.0 PR E) #204 tray: informational primary treated as absent for Session and all Automatic/fallback arms; Claude synthetic placeholder gets "No active 5h session".
• Kimi: omit X-Msh-Device-Id when CLI file missing (no per-fetch UUID churn).

P2 / hygiene

• Document that CostScanOptions is not wired into production CostScanner yet (disk-cache path).
• sub2api settings env label is SUB2API_API_KEY only.

Deferred (not in this PR)

• Factory megafile split (models / credentials / http)
• Full disk-cache wiring for CostScanOptions in CostScanner
• Identity flicker migration (token ↔ email) beyond dropping plan fallback

Test plan

• cargo test --manifest-path rust/Cargo.toml --lib -- factory sub2api interleaved_lineage cost_scan_options kimi claude::web_api
• cargo test --manifest-path apps/desktop-tauri/src-tauri/Cargo.toml -- informational_primary quota_notification
• Manual: toggle provider enablement mid-refresh → follow-up refresh starts
• Manual: Factory cookie-source off + API key → no browser scrape
• Manual: Claude web null five_hour + Session metric → no phantom 0% tray bar