feat: analytics parity — tool cost, date ranges, budgets, query explorer, replay, snapshots (v2.4.0)

Analytics parity phases 2–7 (docs/plans/analytics-parity/), built on
138e706 and ported onto v2.3.1:
- Cost by AI tool (?tool= on cost/analytics/stats/workflows, by_tool,
  Codex fast/priority and flex tiers, agenthub_cost_usd_total{tool,model})
- Date ranges (from/to) on cost/analytics/workflows; Analytics range select
  with Today / This week (Monday) / This month (1st) / 7d / 30d / 90d / All /
  Custom; workflow filters carried into workflow-stats.js (read worker)
- Budgets and cost alerts as alert rule types (alert_rules rebuilt without
  its rule_type CHECK), GET /api/budgets/status, rule preview, spend pace,
  status-bar budget chip; rules stay editable in place
- Query Explorer (/query, allowlisted sort, CSV/JSON export) and scheduled
  reports (report_definitions/report_runs, Settings → Reports)
- Session Replay tab and immutable snapshots (session_snapshots, /snapshot/:token)
- Remote Codex sync, push ingest with a hashed token, privacy redaction and
  ignored folders (Settings → Data), Cursor sessions (no cost)
- Read-only MCP server, statusline, Grafana/Prometheus files

Also: resizable sidebar, pet run/wave animations, the workspace home keeps a
half-typed prompt, and the pre-commit hook runs only the related tests for a
small commit.

client/src/pages/__tests__/Settings.test.tsx

@@ -9,7 +9,7 @@
  */
 
 import { beforeEach, describe, expect, it, vi } from "vitest";
-import { render, screen, waitFor } from "@testing-library/react";
+import { render, screen, waitFor, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { settleConfirm, subscribeConfirm, type PendingConfirm } from "../../lib/confirm";
 
@@ -44,6 +44,14 @@ vi.mock("../../lib/api", async (importOriginal) => {
         clearData: () => clearData(),
         gc: vi.fn(async () => ({ reaped: [], capped: [] })),
         exportData: () => "/api/settings/export",
+        pushToken: { get: vi.fn(async () => ({ enabled: false, env_owned: false })) },
+        privacy: {
+          get: vi.fn(async () => ({
+            redact_secrets: false,
+            ignore_cwd: [],
+            env_owned: { redact_secrets: false, ignore_cwd: false },
+          })),
+        },
       },
     },
   };
@@ -112,7 +120,7 @@ describe("Settings", () => {
     const dialog = screen.getByRole("dialog", { name: /clear all data/i });
     const yes = screen.getByRole("button", { name: /yes, clear all/i });
     expect(yes).toBeDisabled();
-    await user.type(screen.getByRole("textbox"), "clear all data");
+    await user.type(within(dialog).getByRole("textbox"), "clear all data");
     expect(yes).toBeEnabled();
     await user.click(yes);
     await waitFor(() => expect(clearData).toHaveBeenCalled());