fix(usage): read the social-login token key in the free credit API path

[darko-mesaros]

Problem

Users signed in via GitHub/Google social login or Identity Center (org SSO) see no credit pill in the dashboard header. The pill either shows a permanent spinner or hides entirely.

Why it matters

The credit meter is the user's primary visibility into plan usage. With #2039's correct change making the text scrape opt-in (default off), the free API path is the only zero-cost way to surface credits — and it silently fails for two of the four login classes.

Fix (symptoms → root cause → change)

Symptom: Credit pill hidden; /api/sessions/usage returns {available: false}.

Root cause: kiro_usage_api.fetch_usage_limits() searches kiro-cli's SQLite auth_kv table for bearer tokens, but only under two of the four key names kiro-cli uses:

Login method	SQLite key	Before	After
AWS Builder ID (OIDC)	kirocli:odic:token	✅	✅
Legacy CodeWhisperer	codewhisperer:odic:token	✅	✅
GitHub/Google social	kirocli:social:token	❌	✅
Identity Center (org SSO)	kirocli:external-idp:token	❌	✅

Key names confirmed by reverse-engineering kiro-cli binary strings — all four use the same {access_token, expires_at} blob shape.

Change: Add "kirocli:social:token" and "kirocli:external-idp:token" to _SQLITE_TOKEN_KEYS. No parser or format change needed.

This does NOT revert #2039. The text scrape remains opt-in. This fixes the free API path so all login classes get credits without paying for the scrape.

Tests

• test_social_login_token_key_is_recognized — social-key token found from kiro-cli store
• test_external_idp_token_key_is_recognized — external-idp-key token found from kiro-cli store
• All 78 test_kiro_usage_api.py tests pass.

Manual verification

Verified end-to-end on a real social-login host (GitHub, kiro-cli whoami → "Logged in with GitHub"):

• Before: _candidate_tokens() → 0 candidates → fetch_usage_limits → None
• After: _candidate_tokens() → 1 candidate (from_cli_store=True) → GetUsageLimits 200 → {credits_used: 2480.54, credits_plan: 5000.0, plan: "KIRO PRO MAX"}

Closes #2291

[github-actions]

Design Review (Fable 5) — ✅ PASS

Advisory design-level review of 672738aeafda12b5db33ab7e6a3bf3b272833a35 — updated in place on each push; does not block merge.

Design-Verdict: PASS

Root-cause data fix in the mechanism's designated extension point — new keys in _SQLITE_TOKEN_KEYS flow through the existing audited, fail-closed reader unchanged.

Watch

End-to-end verification covers only the social path; the Identity Center claim rests on the shared blob shape plus the "kiro-cli's own store needs no profile ARN" trust rule in _Candidate — if an org-SSO account's GetUsageLimits call does require a profile ARN, that login class stays broken despite the key now being read. Worth one manual check on an Identity Center host before closing #2291 for that class.

[DESIGN-REVIEWED] 672738a

[github-actions]

Opus 5 Review — ✅ no blocking findings

Reviewed 672738aeafda12b5db33ab7e6a3bf3b272833a35 — this comment is updated in place on each push.

Review details

No findings.

[OPUS-REVIEWED] 672738a

Verdict parsed from the review's SHA-scoped output markers for commit 672738aeafda12b5db33ab7e6a3bf3b272833a35.

False positive or not applicable? A repository writer can comment:
/ai-review override fable 672738aeafda12b5db33ab7e6a3bf3b272833a35: <one-sentence reason>

[github-actions]

GPT 5.6 Review — ✅ no blocking findings

GPT 5.6 completed its review of 672738aeafda12b5db33ab7e6a3bf3b272833a35 and found no blocking issues.

This comment is updated in place on each push.

Review details

No findings.
[GPT-REVIEWED] 672738a

False positive or not applicable? A repository writer can comment:
/ai-review override gpt 672738aeafda12b5db33ab7e6a3bf3b272833a35: <one-sentence reason>