limits: stop scheduled dashboard refresh from bypassing quota cache

[pitimon]

Problem

A visible dashboard defaults to a 30-second refresh cadence. The scheduled path calls the same forced quota refresh used by the manual refresh button, which appends refresh=1, clears the two-minute quota cache, and fans out to all configured providers.

Required behavior

• Scheduled dashboard refresh remains visible-only and keeps the selected Off, 30, 60, or 120 second dashboard cadence.
• Scheduled refresh revalidates usage limits through the normal cache-aware endpoint without refresh=1.
• Manual dashboard refresh remains forced and continues to use refresh=1.
• The Limits page initial mount remains forced in this first surgical slice.
• Loading, last-good, and error behavior stays unchanged.

Acceptance evidence

• Hook tests distinguish cached revalidation from forced refresh.
• Dashboard tests prove auto and manual paths choose the correct semantics.
• Limits page test locks the existing forced initial mount.
• Focused dashboard tests and npm run ci:local pass.
• Real local-server smoke shows scheduled-normal calls reuse the cache and manual force refreshes it.

Scope boundary

This issue does not add adaptive 1, 5, or 10 minute polling, provider freshness metadata, credits UI, notifications, or a provider registry.

[pitimon]

Pickup/progress: implementation started from origin/main after #138 merged. T1 is complete in the working branch: the hook now exposes cache-aware revalidate while preserving forced zero-argument refresh, with request-order protection so scheduled work cannot overwrite a manual result. Focused hook tests pass 8/8, plus TypeScript, ESLint, diff-check, anti-pattern review, and code-quality review. Dashboard wiring and integration tests are next.