…th legacy fallback

Tokscale state was scattered across up to four directories per platform.
On macOS specifically the source-message bincode and pricing JSON lived
under ~/Library/Caches/tokscale while the TUI display cache lived under
~/.cache/tokscale, and Wrapped image/font caches were in a third place.
The new defaultClients setting from #464 made this split visible: users
who set TOKSCALE_CONFIG_DIR for an isolated profile got a hermetic
config root but the caches still leaked from the host paths.

Consolidates every cache under <config_dir>/cache so:
- TOKSCALE_CONFIG_DIR controls everything in one shot (hermeticity)
- rm -rf ~/.config/tokscale/cache wipes only regenerable state
- The macOS-vs-Linux directory split is gone

Per-file moves:
- tui-data-cache.json: ~/.cache/tokscale/ -> <config_dir>/cache/
- source-message-cache.bin + .lock: dirs::cache_dir()/tokscale/ -> <config_dir>/cache/
- pricing-litellm.json + pricing-openrouter.json: same as above
- opencode-migration.json: same as above
- fonts/, images/ (Wrapped): ~/.cache/tokscale/<dir>/ -> <config_dir>/cache/<dir>/

Read-side migration is a one-time fallback per file: try the canonical
path first, then probe the legacy locations (gated off when
TOKSCALE_CONFIG_DIR is set). Writes always land at the new path. Legacy
files are left in place so a downgrade keeps working — no copy, no
delete.

Schemas stay at TUI=6, core=7. Path moves alone don't warrant a bump.

Closes #470

…refresh

The 5-minute cache staleness threshold previously gated the render decision on TUI launch: a Stale cache rendered with a background refresh, but a hard Miss (cache older than its hard-expiry window, schema drift, or filter-set mismatch) blocked the user behind a full re-aggregation pass. Schema drift and filter mismatch still produce a Miss because rendering wrong-shape or wrong-filter data is worse than showing nothing — but the time-based staleness check no longer affects the render decision.

The Fresh-vs-Stale distinction stays in CacheResult for future status-bar use (data age metadata), but the call site treats both as renderable. needs_background_load becomes unconditionally true on TUI launch so cached data always gets refreshed.

Closes #471

Adds an opt-in mechanism to warm the TUI cache from a --light run. Previously tokscale --light was strictly read-only — no way to opportunistically refresh the TUI cache from a CLI report even though the underlying UsageData was already computed. Daily-cron users would see a cold TUI on the next interactive launch.

CLI flags:
- --write-cache (requires --light): overwrite the TUI cache atomically after the report renders
- --no-write-cache (requires --light, conflicts with --write-cache): skip the cache write even if the setting opts in

Settings file:
- settings.json grows a light section with writeCache: false default
- #[serde(default)] keeps existing settings.json files loading unchanged

Resolution: --no-write-cache > --write-cache > settings.light.writeCache > false. Cache write uses the existing atomic temp-file rename, so a process crash mid-write never loses the cache.

Closes #472

…iteCache setting

- Cache layout: all regenerable caches now live under <config_dir>/cache. Documented for both posix and Windows in all four language READMEs.
- TOKSCALE_CONFIG_DIR row: clarifies the override now covers caches too.
- light.writeCache row: new opt-in setting documented in the configuration table.
- Cache directory layout subsection: explains what lives where and notes the directory is safe to delete (caches regenerate).

Antigravity's scanner uses PathRoot::Config to resolve where to look
for synced sessions. Without this fix the resolver hardcoded
`{home_dir}/.config/tokscale` as the non-Linux fallback, while
get_antigravity_cache_dir() (the writer side) routes through
paths::get_config_dir() which calls dirs::config_dir() on Windows. The
two diverged on Windows: tokscale antigravity sync wrote to
%APPDATA%\\tokscale\\antigravity-cache\\ while the scanner read from
%USERPROFILE%\\.config\\tokscale\\antigravity-cache\\sessions\\, so
synced data silently never appeared in reports.

PathRoot::Config now mirrors get_config_dir's platform branches:
TOKSCALE_CONFIG_DIR override > Linux XDG_CONFIG_HOME > Windows
dirs::config_dir() > generic `{home}/.config/tokscale`. macOS still
falls through to `{home}/.config/tokscale` because get_config_dir()
deliberately overrides dirs::config_dir() there (which would otherwise
return ~/Library/Application Support/).

New regression test test_path_root_config_uses_dirs_config_dir_on_windows
locks the writer/scanner agreement on Windows.

…ng cache at canonical path

CI runners can have XDG_CONFIG_HOME set globally outside the sandboxed
HOME, so the post-#470 cache resolver leaks the binary's read+write
to the host's config dir. Three integration tests (test_monthly_json_offline_*,
test_submit_offline_*) flaked on Linux runners because the cost
expectations assumed the sandboxed pricing cache (or absence thereof),
but the binary was finding pricing data via the host's
$XDG_CONFIG_HOME/tokscale/cache/ — or worse, would write to it.

offline_cmd_with_home now sets XDG_CONFIG_HOME alongside the existing
XDG_CACHE_HOME and XDG_DATA_HOME pins, mirroring cmd_with_home and
keeping the binary's cache resolution fully inside the temp dir.

write_pricing_cache also seeds the canonical
.config/tokscale/cache/ directory so tests that exercise the new path
work even when legacy fallback is suppressed (e.g. via
TOKSCALE_CONFIG_DIR override).

…ermetic

CI runners that set XDG_CONFIG_HOME globally were leaking the binary's
canonical cache root outside the test's sandboxed HOME, so
SourceMessageCache::load read from the host's
$XDG_CONFIG_HOME/tokscale/cache/source-message-cache.bin (or wrote
there) instead of the temp dir. Three message_cache tests
(test_source_message_cache_round_trip,
load_falls_back_to_legacy_dirs_cache_path,
load_falls_back_to_legacy_dot_cache_path) and one pricing/cache test
(load_falls_back_to_legacy_dirs_cache_path) flaked on Linux runners as
a result.

Adds sandbox_cache_env / restore_cache_env helpers to message_cache so
the round-trip test pins HOME + XDG_CONFIG_HOME + XDG_CACHE_HOME
together. The two legacy-fallback tests gain explicit
XDG_CONFIG_HOME pinning to match. The pricing test does the same.
All 4 now pass on Linux CI.