Update frontend usage card to consume API-header data

[EightRice]

Goal

Surface real subscription utilization on the Claude Max provider card now that the backend reads it directly from anthropic-ratelimit-unified-* response headers.

Backend status (done)

BridgeProvider.refresh_usage() now makes a 1-token call to /v1/messages and parses response headers into _rate_limits:

{
  "five_hour":  { utilization: 0.11, resetsAt: 1777479000, status: "allowed", ... },
  "seven_day":  { utilization: 0.03, resetsAt: 1777978800, status: "allowed", ... },
  "overage":    { utilization: 0.0,  resetsAt: 1777593600, status: "allowed", ... }
}

Same WS contract as before — {type: "provider_refresh_usage", provider_id: "claude_max"} returns the dict above.

Frontend changes

1. Drop the "no data" fallback for missing utilization — it's now reliably populated for all returned windows.
2. Add an Overage row alongside Session (5h) and Week (7d). Optional: hide when utilization === 0 and status === "allowed".
3. Drop any code that expects seven_day_sonnet — the API headers do not break Sonnet out separately. Only the unified bucket is available.
4. Refresh-button behavior: clicking the refresh button now reliably populates fresh data (~1s latency, since it's a direct API call instead of a bridge probe).

Acceptance

• Card shows three rows (or two, hiding overage at 0%) with real percentages matching what /usage displays in Claude Code.
• Refresh button works without spinning up the bridge subprocess.