fix(usage): send OAuth Bearer + anthropic-beta header for /v1/messages probe (#24)

Follow-up to #21. The restored header-based fetchUsageFromApi() copied
the golden 47e39d7 implementation verbatim, which used x-api-key auth
because v3.0.0 targeted API-key users (sk-ant-api03-*). Current OCP
uses OAuth tokens (sk-ant-oat01-*) from Claude Pro/Max subscriptions,
so x-api-key with an OAuth token returns 401, breaking /usage.

Claude Code cli.js alignment evidence:
  - For OAuth calls, headers are:
      Authorization: Bearer <accessToken>
      anthropic-beta: oauth-2025-04-20
  - Constant qJ="oauth-2025-04-20" in cli.js
  - Multiple call sites confirmed (e.g. /v1/files upload, /v1/sessions)

Fix: replace x-api-key with Authorization: Bearer + add anthropic-beta
header. Matches the exact headers cli.js sends for every OAuth request.

ALIGNMENT.md compliance: change aligns OCP with cli.js; CI blacklist
unaffected.

Co-authored-by: Oracle Public Cloud User <opc@instance-20230820-1333.subnet07301351.vcn07301351.oraclevcn.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

server.mjs

@@ -810,8 +810,9 @@ async function fetchUsageFromApi() {
   const doFetch = (bearerToken) => fetch("https://api.anthropic.com/v1/messages", {
     method: "POST",
     headers: {
-      "x-api-key": bearerToken,
+      "Authorization": `Bearer ${bearerToken}`,
       "anthropic-version": "2023-06-01",
+      "anthropic-beta": "oauth-2025-04-20",
       "Content-Type": "application/json",
     },
     body,