fix(cliproxy): clear stale auth quota cache

- invalidate per-account quota cache entries after successful OAuth account registration

- add regression coverage for the Claude stale-reauth dashboard path

src/web-server/routes/cliproxy-auth-routes.ts

@@ -33,6 +33,7 @@ import {
 } from '../../cliproxy/proxy-target-resolver';
 import { fetchRemoteAuthStatus } from '../../cliproxy/remote-auth-fetcher';
 import { ensureManagedModelPrefixes } from '../../cliproxy/managed-model-prefixes';
+import { invalidateQuotaCache } from '../../cliproxy/quota-response-cache';
 import { loadOrCreateUnifiedConfig } from '../../config/unified-config-loader';
 import { tryKiroImport } from '../../cliproxy/auth/kiro-import';
 import {
@@ -190,6 +191,13 @@ function shouldKeepWaitingForLocalToken(
   );
 }
 
+function invalidateQuotaForRegisteredAccount(account: {
+  provider: CLIProxyProvider;
+  id: string;
+}): void {
+  invalidateQuotaCache(account.provider, account.id);
+}
+
 function parseKiroMethod(raw: unknown): { method: KiroAuthMethod; invalid: boolean } {
   if (raw === undefined || raw === null) {
     return { method: normalizeKiroAuthMethod(), invalid: false };
@@ -1022,6 +1030,7 @@ router.get('/:provider/status', async (req: Request, res: Response): Promise<voi
       } catch {
         // Keep manual callback success path non-fatal when prefix repair cannot run.
       }
+      invalidateQuotaForRegisteredAccount(account);
       res.json({
         status: 'ok',
         account: {
@@ -1173,6 +1182,7 @@ router.post('/:provider/submit-callback', async (req: Request, res: Response): P
           // Keep manual callback success path non-fatal when prefix repair cannot run.
         }
       }
+      invalidateQuotaForRegisteredAccount(account);
 
       res.json({
         success: true,
@@ -1205,6 +1215,8 @@ router.post('/:provider/submit-callback', async (req: Request, res: Response): P
       return;
     }
 
+    invalidateQuotaForRegisteredAccount(account);
+
     res.json({
       success: true,
       account: {