Sync human-readable Claude and Codex account names across Macs

[robinebers]

Problem

The account-aware iCloud sync added in #1140 correctly keeps different Claude and Codex accounts separate across Macs, but it currently synchronizes only their stable account identifiers. An account that exists on another Mac therefore appears in Total Spend as an opaque value such as codex@ab12cd34 or claude@ab12cd34.

This is confusing in a normal multi-Mac setup. For example, if Mac A uses a personal Codex account and Mac B uses a work Codex account, each Mac can include the other account's usage in its combined chart, but it cannot explain which account the remote entry actually represents.

Excluding human-readable account names from the existing private iCloud payload was an implementation choice, not an intentional product or privacy requirement.

Proposed change

Sync account display metadata through the existing private iCloud history documents alongside each account's verified identity. Use that metadata to show recognizable names for remote-only accounts and keep account names consistent wherever cross-Mac usage appears.

Examples:

• codex@ab12cd34 becomes Codex — Personal or Codex — Work.
• claude@ef567890 becomes Claude — SUNSTORY or Claude — Personal.
• A user-defined account nickname such as Codex — Client Project is available on the user's other Macs.

Account matching must continue to use the verified provider account/organization identity; display names are presentation metadata and must never determine ownership or merge unrelated accounts.

Acceptance criteria

• iCloud history includes human-readable display metadata for verified Claude and Codex accounts, including organization/workspace names and user-defined account nicknames when available.
• Remote-only accounts in Total Spend use the synced account name instead of an opaque account hash whenever a name is available.
• Codex accounts discovered through the normal Keychain-backed refresh can provide a useful remote label without adding another credential read or permission prompt.
• Renaming an account causes the updated label to reach other synced Macs, with a deterministic policy for conflicting names or simultaneous edits.
• Existing account-safe matching, separate organization histories, remote-only account behavior, and stable account chart colors remain unchanged.
• Older documents without display metadata continue working and fall back to the existing account-code label.
• Authentication tokens, passwords, raw conversation logs, and unrelated secrets are never added to the iCloud payload.
• Update the iCloud sync and privacy documentation to describe which account display metadata is shared through the user's private iCloud account.

Related: #1140