feat(devtools/claude-usage): resolve Claude Code OAuth credentials (no claude-hud)

[jaeyeom]

Parent

Part of #199 — port claude-usage into devtools/.

Depends on progress in the scaffold/CLI issue; can start in parallel behind an interface.

Problem

The local script relies on claude-hud’s getUsage(), which resolves Claude Code OAuth credentials (macOS Keychain service names derived from CLAUDE_CONFIG_DIR / ~/.claude). A repo tool should resolve credentials itself so users do not need the claude-hud plugin cache.

Background (from claude-hud usage-api)

• Legacy Keychain service name: Claude Code-credentials
• Custom config dirs use a hashed service name suffix
• Credentials include an access token + subscription type
• API-key-only users (no OAuth) cannot use this endpoint — tool should fail gracefully
• Custom ANTHROPIC_BASE_URL / non-Anthropic endpoints: usage API is not applicable

Scope

• Implement internal/credentials (or equivalent) to load OAuth access token for Claude Code
• Support:
  • default ~/.claude and CLAUDE_CONFIG_DIR
  • macOS Keychain lookup (primary path for Claude Code OAuth)
  • document behavior on Linux/Windows (best-effort or explicit unsupported)
• Security:
  • never print/log the token
  • avoid putting the token in process argv
  • prefer short-lived in-memory use only
• Clear errors: missing keychain item, expired token, API-key user, keychain prompt/backoff cases

Acceptance criteria

• Can obtain an access token on macOS for a normal Claude Code OAuth install without claude-hud installed
• Unit tests cover service-name derivation and parsing with fixtures (no live Keychain required in CI)
• Integration path documented for manual verification
• Token never appears in logs or CLI output

References

• Local script: ~/.local/bin/claude-usage
• claude-hud: usage-api.js / getKeychainServiceName, resolveKeychainCredentials