* Improve codexbar command path recovery

* Fix reset-time labels, dense chart overflow, and descriptor secret argv

Three defects found while auditing the popup rendering and the descriptor
write path:

- resetLabel() split digit-then-letter as well as letter-then-digit, so the
  compact durations resetText() produces ("2h 30m", "2d 4h") were rendered as
  "Resets 2 h 30 m" in the provider rows, the Overview rows, the quota
  notification body and the resetTime panel mode. Keep only the
  letter-then-digit split, which is what actually separates a run-together
  CLI string such as "Resets5h30m".

- Both bar charts floored the gap at 2px and the bar width at 1-2px, then
  advanced x by (barWidth + gap). Once the point count passed roughly
  width/4 the pitch no longer fit the canvas: a 365-day cost history painted
  its last bar around x=1458 on a 560px canvas, so the newest ~60% of the
  data was clipped away silently. Derive gap and bar width from a single
  step = width / count in one shared chartBarGeometry() helper, so the last
  bar always lands inside width for every count the normalizers allow (365
  cost-history days, 120 detail-chart points).

- writeDescriptorField() expanded the field value into the "{value}"
  placeholder unconditionally while also piping it on stdin for secret
  fields, which would have published the secret in the child process argv.
  Secrets now go to stdin only, matching promptDescriptorSecret().

Also drop the two unreachable providerIconSource alias entries: the map is
keyed by the already-resolved providerKey, so "aws-bedrock" and "kimi-k2"
can never be looked up there.

make check passes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>