Identify the Muse account per session host before attributing subscription usage #17397

Summary

Read account identity from each Muse session host with experimental account/read. Use that identity to attribute the host's usage/changed reports instead of relying only on the account found by the separate status host.

Requested by @ntindle as a follow-up to #17151.

Rationale

Muse usage/changed reports contain no account identity. Session hosts capture the usage account generation when they start, while a separate status host checks the logged-in account.

A session can start before the first status check finishes. If an external muse login changes the account during that interval, the first account named by the status check may not identify the account used by that session host. A similar attribution gap exists when an account changes between status checks.

Incrementing the generation when the first account is identified does not establish the session host's identity. It rejects all later usage reports from sessions started before that check until their hosts restart. Preserve the current first-identification behavior while implementing per-host identification.

Required changes

• Enable and request experimental account/read on each session host.
• Associate the decoded account identity with that host's usage-report lifecycle.
• Define safe handling for reports that arrive before account identification and for unknown, invalid, or timed-out account responses. Do not treat a separate status host's identity as proof of a session host's identity.
• Reconcile per-host identity with account-generation handling so reports from an old account cannot appear under a replacement account.
• Keep account identification bounded so an unresponsive account/read does not block session startup indefinitely.
• Update tests and user documentation for the resulting attribution guarantees and remaining limitations.

Affected areas

• packages/provider-muse/src/server/adapter.ts: session-host startup and usage/changed handling.
• packages/provider-muse/src/server/driver.ts: retained usage reports and account-generation checks.
• packages/provider-muse/src/server/usageLimits.ts: account identity and generation transitions.
• packages/provider-muse/src/server/sdk.ts, protocol.ts, and modelCatalog.ts: experimental API support, account schemas, and existing account probe behavior.
• Related Muse tests and docs/user/providers-muse.md.

Acceptance criteria

• A session started before the first status check can continue updating Limits when its host identifies the same account.
• Reports from a host using a different account are not attributed to the account named by the status host.
• Tests cover account changes before the first status check and between subsequent checks.
• Tests cover delayed reports, unknown account identity, malformed account responses, and account-read timeout.
• Tests cover signed-out and API-key hosts without inventing a subscription account identity.
• Existing account deduplication and quota handling remain intact.
• Documentation describes any remaining attribution limitations.

Context

• PR: feat(providers): show Muse Code subscription usage in Limits #17151
• Review discussion and follow-up request: feat(providers): show Muse Code subscription usage in Limits #17151 (comment)