feat(worker): add OAuth usage client + poller

Adds Usage/ with ClaudeOAuthUsageClient (reads the access token Claude
Code keeps fresh at ~/.claude/.credentials.json, calls the Anthropic
OAuth usage endpoint, defensively parses buckets/limits), UsageState
(threadsafe last-good-snapshot holder that never regresses on
failure), and UsageMonitorService (BackgroundService polling on the
new usage_poll_interval_seconds config, min 15s, one poll at startup,
warns at most once per distinct error).

tests/ClaudeDo.Worker.Tests/Usage/UsageMonitorServiceTests.cs

@@ -0,0 +1,68 @@
+using ClaudeDo.Worker.Config;
+using ClaudeDo.Worker.Usage;
+using ClaudeDo.Worker.Usage.Interfaces;
+using Microsoft.Extensions.Logging.Abstractions;
+
+namespace ClaudeDo.Worker.Tests.Usage;
+
+public sealed class UsageMonitorServiceTests
+{
+    private sealed class FakeClient : IUsageClient
+    {
+        public Queue<Func<UsageSnapshot>> Results { get; } = new();
+        public int CallCount { get; private set; }
+
+        public Task<UsageSnapshot> GetUsageAsync(CancellationToken ct = default)
+        {
+            CallCount++;
+            var next = Results.Count > 0 ? Results.Dequeue() : () => throw new InvalidOperationException("no result queued");
+            return Task.FromResult(next());
+        }
+    }
+
+    private static UsageSnapshot MakeSnapshot() => new(new UsageBucket(1, null), null, [], DateTime.UtcNow);
+
+    [Fact]
+    public async Task TickAsync_Success_UpdatesState()
+    {
+        var client = new FakeClient();
+        client.Results.Enqueue(MakeSnapshot);
+        var state = new UsageState();
+        var service = new UsageMonitorService(client, state, new WorkerConfig(), NullLogger<UsageMonitorService>.Instance);
+
+        await service.TickAsync(CancellationToken.None);
+
+        Assert.NotNull(state.Snapshot);
+        Assert.Null(state.LastError);
+    }
+
+    [Fact]
+    public async Task TickAsync_Failure_SetsErrorButDoesNotThrow()
+    {
+        var client = new FakeClient();
+        client.Results.Enqueue(() => throw new InvalidOperationException("network unreachable"));
+        var state = new UsageState();
+        var service = new UsageMonitorService(client, state, new WorkerConfig(), NullLogger<UsageMonitorService>.Instance);
+
+        await service.TickAsync(CancellationToken.None);
+
+        Assert.Equal("network unreachable", state.LastError);
+        Assert.Null(state.Snapshot);
+    }
+
+    [Fact]
+    public async Task TickAsync_FailureAfterSuccess_KeepsOldSnapshot()
+    {
+        var client = new FakeClient();
+        client.Results.Enqueue(MakeSnapshot);
+        client.Results.Enqueue(() => throw new InvalidOperationException("down"));
+        var state = new UsageState();
+        var service = new UsageMonitorService(client, state, new WorkerConfig(), NullLogger<UsageMonitorService>.Instance);
+
+        await service.TickAsync(CancellationToken.None);
+        await service.TickAsync(CancellationToken.None);
+
+        Assert.NotNull(state.Snapshot);
+        Assert.Equal("down", state.LastError);
+    }
+}