feat: add Kimi Code session monitoring and account quota

[SihanTeng]

Summary

Adds first-class Kimi Code support while keeping session monitoring local-only and making account quota an explicit, bounded exception.

• Sessions: discover live kimi processes, map each process cwd to Kimi workspaces, and incrementally parse agents/main/wire.jsonl for tokens, model, context, status, current tools, subagent names, children, and ports.
• Quota: read the local abtop-rate-limits.json cache and render Kimi beside Claude and Codex. The long Kimi window is labeled as the plan period rather than an incorrect seven-day window.
• Explicit setup: abtop --setup installs the Kimi quota companion. The normal TUI never auto-installs it.
• Refresh lifecycle: the full TUI may run an already-installed companion at most every two minutes. Refresh is non-blocking and child processes are reaped.
• Privacy boundary: session monitoring performs local reads only. The optional companion reuses the existing Kimi OAuth login and calls the Kimi usage endpoint; it is never invoked by --once, --json, or when Kimi is hidden.
• Failure behavior: the last valid Kimi quota remains visible but dimmed when stale, so network or authentication failures do not erase the gauge.

Quality fixes

• Cache Kimi process cwd discovery to avoid one lsof call per PID every two seconds on macOS.
• Correct token history to include cache-read tokens.
• Clear completed tool state and avoid showing stale tools while Kimi is thinking.
• Redact secrets and suppress raw Agent prompts from task previews.
• Share process cwd and path comparison logic with the OpenCode collector.
• Reject stale Claude hook data without discarding the intentionally persistent Codex cache.
• Add compact quota rendering so three providers remain readable in narrow panels.

Product contract

Kimi session discovery remains filesystem/process based and never uploads transcript or prompt content. Live Kimi account quota cannot be both current and strictly network-free because Kimi does not expose account quota in local session state. The networked quota path is therefore explicit through abtop --setup, documented, isolated in the companion, and disabled for headless snapshots and hidden Kimi configurations.

Limitations

• Kimi subagents expose names only; per-subagent token and status polling is not implemented.
• Multiple live Kimi processes in one cwd claim the newest session directories first.
• Context windows are derived from known Kimi model aliases.
• The optional quota companion requires python3, a working network connection, and an existing kimi login.

Verification

• cargo test: 218 unit tests and 1 documentation test
• cargo clippy --all-targets -- -D warnings
• cargo build
• Rust formatting and git diff checks
• Python syntax and quota-response parser smoke tests
• Live JSON snapshot contains Kimi quota with correct five-hour and plan-period values
• hidden_agents hides the Kimi collector and skips quota refreshes

How to try

1. Log in with kimi login.
2. Run cargo run -- --setup once to install the optional quota companion.
3. Run cargo run to launch the TUI.
4. Use hidden_agents = ["kimi"] to disable both Kimi sessions and quota refreshes.