feat: analytics parity — tool cost, date ranges, budgets, query explorer, replay, snapshots (v2.4.0)

Analytics parity phases 2–7 (docs/plans/analytics-parity/), built on
138e706 and ported onto v2.3.1:
- Cost by AI tool (?tool= on cost/analytics/stats/workflows, by_tool,
  Codex fast/priority and flex tiers, agenthub_cost_usd_total{tool,model})
- Date ranges (from/to) on cost/analytics/workflows; Analytics range select
  with Today / This week (Monday) / This month (1st) / 7d / 30d / 90d / All /
  Custom; workflow filters carried into workflow-stats.js (read worker)
- Budgets and cost alerts as alert rule types (alert_rules rebuilt without
  its rule_type CHECK), GET /api/budgets/status, rule preview, spend pace,
  status-bar budget chip; rules stay editable in place
- Query Explorer (/query, allowlisted sort, CSV/JSON export) and scheduled
  reports (report_definitions/report_runs, Settings → Reports)
- Session Replay tab and immutable snapshots (session_snapshots, /snapshot/:token)
- Remote Codex sync, push ingest with a hashed token, privacy redaction and
  ignored folders (Settings → Data), Cursor sessions (no cost)
- Read-only MCP server, statusline, Grafana/Prometheus files

Also: resizable sidebar, pet run/wave animations, the workspace home keeps a
half-typed prompt, and the pre-commit hook runs only the related tests for a
small commit.

server/__tests__/remote-sources.test.js

@@ -97,6 +97,22 @@ describe("remote-sync validateSourceInput", () => {
     assert.equal(v.remoteHome, "~/.claude");
   });
 
+  it("defaults Codex off and places its home beside Claude's (WSL included)", () => {
+    const v = remoteSync.validateSourceInput({ label: "L", host: "h" });
+    assert.equal(v.syncCodex, 0);
+    assert.equal(v.remoteCodexHome, null);
+    assert.equal(remoteSync.normalizedCodexHome({ remote_home: null }), "~/.codex");
+    assert.equal(remoteSync.normalizedCodexHome({ remote_home: "wsl:~/.claude" }), "wsl:~/.codex");
+    assert.equal(
+      remoteSync.normalizedCodexHome({ remote_home: "~/.claude", remote_codex_home: "/opt/cx" }),
+      "/opt/cx"
+    );
+    assert.equal(
+      remoteSync.wslTarRemoteCmd("~/.codex", "sessions"),
+      "wsl.exe -e sh -c 'tar -cC ~/.codex/sessions .'"
+    );
+  });
+
   it("accepts a config-alias host with no user", () => {
     const v = remoteSync.validateSourceInput({ label: "x", host: "mybox" });
     assert.equal(v.host, "mybox");
@@ -412,6 +428,27 @@ describe("/api/remote-sources CRUD", () => {
     assert.equal(res.body.source.ssh_port, 22); // unchanged
   });
 
+  it("stores the Codex opt-in and its home, and a patch of one keeps the other", async () => {
+    const res = await post("/api/remote-sources", {
+      label: "Codex box",
+      host: "son@codexbox",
+      sync_codex: true,
+      remote_codex_home: "~/.codex-work",
+      enabled: false,
+    });
+    assert.equal(res.status, 201);
+    assert.equal(res.body.source.sync_codex, true);
+    assert.equal(res.body.source.remote_codex_home, "~/.codex-work");
+    const id = res.body.source.id;
+    const off = await patch(`/api/remote-sources/${id}`, { sync_codex: false });
+    assert.equal(off.body.source.sync_codex, false);
+    assert.equal(off.body.source.remote_codex_home, "~/.codex-work");
+    const bad = await patch(`/api/remote-sources/${id}`, { remote_codex_home: "~/x;rm -rf /" });
+    assert.equal(bad.status, 400);
+    assert.equal(bad.body.error.code, "INVALID_REMOTE_CODEX_HOME");
+    await del(`/api/remote-sources/${id}`);
+  });
+
   it("404s for an unknown id", async () => {
     const res = await patch("/api/remote-sources/src_nope", { label: "x" });
     assert.equal(res.status, 404);