feat: analytics parity — tool cost, date ranges, budgets, query explorer, replay, snapshots (v2.4.0)

Analytics parity phases 2–7 (docs/plans/analytics-parity/), built on
138e706 and ported onto v2.3.1:
- Cost by AI tool (?tool= on cost/analytics/stats/workflows, by_tool,
  Codex fast/priority and flex tiers, agenthub_cost_usd_total{tool,model})
- Date ranges (from/to) on cost/analytics/workflows; Analytics range select
  with Today / This week (Monday) / This month (1st) / 7d / 30d / 90d / All /
  Custom; workflow filters carried into workflow-stats.js (read worker)
- Budgets and cost alerts as alert rule types (alert_rules rebuilt without
  its rule_type CHECK), GET /api/budgets/status, rule preview, spend pace,
  status-bar budget chip; rules stay editable in place
- Query Explorer (/query, allowlisted sort, CSV/JSON export) and scheduled
  reports (report_definitions/report_runs, Settings → Reports)
- Session Replay tab and immutable snapshots (session_snapshots, /snapshot/:token)
- Remote Codex sync, push ingest with a hashed token, privacy redaction and
  ignored folders (Settings → Data), Cursor sessions (no cost)
- Read-only MCP server, statusline, Grafana/Prometheus files

Also: resizable sidebar, pet run/wave animations, the workspace home keeps a
half-typed prompt, and the pre-commit hook runs only the related tests for a
small commit.

server/lib/event-payload.js

@@ -8,10 +8,14 @@
  * snapshot of it under `<data dir>/transcripts/`), which the Conversation tab
  * reads. Kept: every field outside `tool_input`/`tool_response`, every number and
  * flag, `structuredPatch` (the +/- line counts), and each long string's head and
- * tail. Dropped fields are named in `_trimmed`, so a view can say so.
+ * tail. Dropped fields are named in `_trimmed`, so a view can say so. When
+ * the user turned on secret redaction (`server/lib/privacy.js`), the payload is
+ * redacted first, before anything is cut.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
+const { redactEventJson } = require("./privacy");
+
 // Strings inside tool_input / tool_response longer than this keep head + tail.
 const STR_CAP = 8192;
 const HEAD = 6000;
@@ -95,6 +99,9 @@ function trimHookPayload(data, hit = { n: 0 }) {
  * @returns {string|null}
  */
 function trimEventData(json) {
+  // Opt-in secret redaction runs first, on the whole text: trimmed first, a
+  // private key cut in two would no longer match its pattern.
+  json = redactEventJson(json);
   if (typeof json !== "string" || json.length <= SKIP_UNDER) return json;
   let parsed;
   try {