feat(usage): Grok subscription usage reader #1103

Motivation

Grok is a registered provider with no usage visibility. Research (spec §Readers/grok) verified the transport: GET https://cli-chat-proxy.grok.com/v1/billing?format=credits with the long-lived key from ~/.grok/auth.json (read-only, 0600) and the required X-XAI-Token-Auth: xai-grok-cli header. Base URL confirmed present in the installed grok 1.0.30 binary.

Spec: docs/superpowers/specs/2026-09-20-provider-usage-enablement-design.md §Readers/grok.

Intended behavior

• Registry entry grok activated when the Grok provider kind is enabled.
• Reads ~/.grok/auth.json (first non-empty key, size-capped read), checks expires_at.
• Expired login ⇒ actionable error row ("start any Grok session to refresh"); self-heals on the next 60s poll after a Grok session refreshes the file. Never writes auth.json; never reimplements the OIDC refresh.
• Maps subscriptionTier, config.creditUsagePercent, currentPeriod.end, productUsage[] to plan/rows/detail. Credits row is all-models scope; product rows model-family.

Phase 2 of the spec. Depends on the usage-source registry from the Phase 1 issue.

Acceptance criteria

• Reader + mapping unit tested against captured fixtures (fresh capture with a live login during this PR; fixture stores response body only).
• Expiry branch tested; error copy actionable.
• Keys never logged/cached/echoed (sanitized error path tested).
• Grok row renders in the modal rail/detail when enabled.