refactor!: rebrand CCAM to AgentHub

Clean break, no compatibility alias. Renames the product name, the CLI
binary (`ccam` -> `agenthub`), the env var prefix (`CCAM_` ->
`AGENTHUB_`), the Prometheus metric namespace (`ccam_*` ->
`agenthub_*`), the tmux session prefix (`ccam-lane-<id>` ->
`agenthub-lane-<id>`), the per-repo runtime profile directory
(`.ccam/profile` -> `.agenthub/profile`), the lanes state root
(`~/.claude/ccam-lanes` -> `~/.claude/agenthub-lanes`), the bundled
plugins (`plugins/ccam*` -> `plugins/agenthub*`) and their slash
commands (`/ccam-doctor` -> `/agenthub-doctor`, `/ccam:*` ->
`/agenthub:*`).

Because there is no alias, an existing install has to be updated by
hand: rename its `.ccam/profile` directory and any `CCAM_*` variables,
and reinstall the plugin under its new name.

Two other name families are deliberately left alone here, since they are
not just strings: the `Claude-Code-Monitor` repository/marketplace name,
and the `agent-dashboard` npm package plus its `~/.claude/agent-dashboard`
runtime directory, which holds the live database and needs a migration
rather than a rename.

Verified: server 1406/1406, client 459/459, `grep -i ccam` clean across
tracked files, `openapi.yaml` regenerated (95 paths, unchanged count).

plugins/agenthub-insights/skills/anomaly-alert/SKILL.md

@@ -0,0 +1,88 @@
+---
+description: >
+  Identify anomalous sessions using Agent Monitor data — cost outliers from
+  the pricing engine, token anomalies (cache miss spikes, compaction baseline
+  surges), unusual event type ratios (PreToolUse/PostToolUse gaps, APIError
+  clusters), behavioral deviations from workflow intelligence (complexity
+  score outliers, error propagation anomalies), and sessions with abnormal
+  metadata (extreme turn_count, high thinking_blocks, zero turn_duration).
+---
+
+# Anomaly Alert
+
+Detect anomalous sessions in AgentHub data.
+
+## Input
+
+The user provides: **$ARGUMENTS**
+
+This may be:
+- "all" or empty (default: check all anomaly types)
+- "cost" for cost anomalies only
+- "duration" for duration anomalies only
+- "errors" for error rate anomalies only
+- A sensitivity level: "strict" (1σ), "normal" (2σ), "relaxed" (3σ)
+
+## Procedure
+
+1. **Fetch baseline data** from `http://localhost:4820`:
+   - `GET /api/sessions?limit=500` — historical sessions for baseline
+   - `GET /api/analytics` — aggregated metrics
+   - `GET /api/pricing/cost` — cost data per session
+
+2. **Compute baselines** for each metric:
+   - Mean, median, standard deviation
+   - P25, P75, P90, P95, P99 percentiles
+   - Interquartile range (IQR) for robust outlier detection
+
+3. **Detect anomalies** using statistical thresholds:
+
+   ### Cost Anomalies
+   - Sessions costing >2σ above mean
+   - Single sessions exceeding daily average
+   - Sudden cost spikes (session-over-session increase >200%)
+
+   ### Duration Anomalies
+   - Sessions lasting >2σ above mean duration
+   - Extremely short sessions (<1 minute) that still incur cost
+   - Sessions with unusual active-vs-idle ratios
+
+   ### Error Rate Anomalies
+   - Sessions with error rates >2σ above baseline
+   - New error types not seen in previous sessions
+   - Sessions with >3 consecutive tool failures
+
+   ### Behavioral Anomalies
+   - Unusual tool combinations not seen before
+   - Sessions with abnormally high compaction counts
+   - Model switches mid-session (if unexpected)
+   - Sessions with no tool usage (pure conversation)
+
+   ### Token Anomalies
+   - Input/output token ratio far from historical norm
+   - Cache miss rate significantly higher than average
+   - Token usage growing faster than session count
+
+4. **Classify each anomaly**:
+   - **🔴 Critical**: Likely indicates a real problem requiring attention
+   - **🟡 Warning**: Unusual but may be expected for certain tasks
+   - **🔵 Info**: Interesting deviation worth noting
+
+## Output Format
+
+Present as an **Anomaly Report**:
+
+```
+═══════════════════════════════════════════════
+  ANOMALY DETECTION REPORT
+  Analyzed: N sessions | Baseline: last 30 days
+  Anomalies found: N (🔴 N critical, 🟡 N warn, 🔵 N info)
+═══════════════════════════════════════════════
+```
+
+For each anomaly:
+- Session ID and timestamp
+- Anomaly type and severity
+- Observed value vs expected range
+- Possible explanation
+- Recommended action (if any)