fix(panel): Claude limit resets, setup-token query, official-setup-token

[dofastted]

Summary

• reset-status / reset-redeem 固定 claude-cli/<version> (external, cli)。遥测 UA claude-code/ 会被上游标成 ineligible_reason=surface，查询次数为 0。
• Claude 槽始终显示「限额查询 / 限额重置」，Codex 槽始终显示「券查询 / 重置券」。
• 带 user:profile 的 转换后 Setup Token 可以查询兑换；纯 inference 和 API Key 点查询仍 400。
• 官方 claude setup-token（一年期、仅 inference、无 refresh）落盘为 official-setup-token，面板文案「官方 Setup Token」。Cookie/授权链转换的完整票仍是 setup-token。office-setup-token 视为同一类型。
• README 徽标改为 v1.3.94；/tmp/ 验证草稿加入 gitignore。

Test plan

• node --test test/unit/claude-reset-credits.test.mjs
• node --test test/unit/credential-mode.test.mjs test/unit/oauth-credentials.test.mjs
• go test ./internal/oauthcmd/ ./internal/credential/
• HostDzire：vm-13 / vm-05 可查到 1 次；vm-03 上游 tenure 不可兑

Deploy

更新 Node、web/dist、bin/kin-worker，重启 kin-gateway 一次，并 docker restart 挂载了 worker 的槽。kernel / cli-node 未变，不需要 wrap-cli/sync。不要 docker rm。

---

Note

Medium Risk
Changes OAuth credential classification, import paths, and upstream limit-reset behavior; misclassification could block refresh or incorrectly allow reset queries, though scope checks and new tests mitigate this.

Overview
Introduces official-setup-token as a distinct credential mode for year-long CLI claude setup-token grants (inference-only, no refresh), separate from panel-converted setup-token tickets that can still carry full scopes. Import, exchange, persistence, and inference routing now classify and store these types differently; official tokens cannot refresh, convert to full setup-token, or use official usage APIs, while both setup-token flavors still share inference-style outbound headers.

Claude native limit-reset eligibility is refined: API keys and official setup tokens are excluded, but converted setup-token slots with user:profile can query/redeem; pure inference and API key attempts still fail with profile-scope errors. VMs expose can_claude_reset to the panel so Claude vs Codex reset buttons are shown by platform rather than only full OAuth.

Docs/changelog note reset-status / reset-redeem using claude-cli/<version> (external, cli) UA (telemetry UA yields zero eligible resets). Minor housekeeping: README v1.3.94 badge, /tmp/ in .gitignore, rebuilt web/dist, and expanded unit/e2e tests for the new modes.

^{Reviewed by Cursor Bugbot for commit acd8d6c. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 5aaf4565-3ace-44b2-be4b-d252f20d4ad3)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: fbe50304-4e2f-41e6-a678-1b1e258fab03)