Refresh rate-limits watch for account and secret changes

Summary

diag rate-limits --async --watch now refreshes the active-account highlight and secret list every watch round. This lets long-running watch sessions reflect auth use ... account switches and secret add/remove changes without restarting.

Changes

• Re-scan CODEX_SECRET_DIR each watch round instead of using a startup-only secret snapshot.
• Re-resolve current auth-matched secret every watch round so current-account coloring can change after auth use.
• Add CODEX_RATE_LIMITS_WATCH_INTERVAL_SECONDS for test-time watch interval override.
• Add unit tests for async secret discovery and auth-basename switching.
• Add integration test covering multi-round watch with secret removal/addition and updated last-rendered rows.

Testing

• cargo test -p nils-codex-cli rate_limits_async -- --nocapture (pass)
• ./.agents/skills/nils-cli-verify-required-checks/scripts/nils-cli-verify-required-checks.sh (pass)
• mkdir -p target/coverage && cargo llvm-cov nextest --profile ci --workspace --lcov --output-path target/coverage/lcov.info --fail-under-lines 85 && scripts/ci/coverage-summary.sh target/coverage/lcov.info (pass, 86.57%)

Risk / Notes

• Watch mode now tolerates temporary empty secret lists during runtime and keeps running to allow later re-additions.