Extend rate limit reads with usage capabilities (#42358)

## What changed

- Accept optional `account/rateLimits/read` capabilities for Luna Reserve support
  and lightweight background polling while preserving omitted and `null` params.
- Forward the Luna Reserve capability only for eligible ChatGPT sessions, and let
  lightweight polls skip the separate reset-credit detail request.
- Return the backend's `ordinaryUsageAllowed` decision only when its account and
  user identity match the active session.

## Testing

- Cover capability defaults, eligible and restricted authentication modes,
  lightweight polling, identity filtering, and backend permission handling.

GitOrigin-RevId: f407a3ae1e70e411fdf245f072a16e453f59cd87

codex-rs/app-server-protocol/src/export.rs

@@ -2154,6 +2154,11 @@ mod tests {
             "params?: GetAccountTokenUsageParams | undefined, }"
         );
         assert!(client_request_ts.contains(LEGACY_ACCOUNT_USAGE_REQUEST));
+        const LEGACY_ACCOUNT_RATE_LIMITS_REQUEST: &str = concat!(
+            "{ \"method\": \"account/rateLimits/read\", id: RequestId, ",
+            "params?: GetAccountRateLimitsParams | undefined, }"
+        );
+        assert!(client_request_ts.contains(LEGACY_ACCOUNT_RATE_LIMITS_REQUEST));
         let account_usage_response_ts = std::str::from_utf8(
             fixture_tree
                 .get(Path::new("v2/GetAccountTokenUsageResponse.ts"))
@@ -2232,12 +2237,16 @@ mod tests {
                 });
 
             let contents = std::str::from_utf8(contents)?;
-            // The stable usage RPC originally required `params: undefined`. Keep that exact
-            // legacy value accepted while extending the same method with optional thread params.
-            let legacy_account_usage_undefined = path == Path::new("ClientRequest.ts")
-                && contents.matches("| undefined").count() == 1
-                && contents.contains(LEGACY_ACCOUNT_USAGE_REQUEST);
-            if contents.contains("| undefined") && !legacy_account_usage_undefined {
+            // Both stable usage RPCs originally required `params: undefined`. Preserve that
+            // source compatibility only for these exact envelopes, not arbitrary new fields.
+            let checked_contents = if path == Path::new("ClientRequest.ts") {
+                contents
+                    .replace(LEGACY_ACCOUNT_USAGE_REQUEST, "")
+                    .replace(LEGACY_ACCOUNT_RATE_LIMITS_REQUEST, "")
+            } else {
+                contents.to_owned()
+            };
+            if checked_contents.contains("| undefined") {
                 undefined_offenders.push(path.clone());
             }