feat: analytics parity — tool cost, date ranges, budgets, query explorer, replay, snapshots (v2.4.0)

Analytics parity phases 2–7 (docs/plans/analytics-parity/), built on
138e706 and ported onto v2.3.1:
- Cost by AI tool (?tool= on cost/analytics/stats/workflows, by_tool,
  Codex fast/priority and flex tiers, agenthub_cost_usd_total{tool,model})
- Date ranges (from/to) on cost/analytics/workflows; Analytics range select
  with Today / This week (Monday) / This month (1st) / 7d / 30d / 90d / All /
  Custom; workflow filters carried into workflow-stats.js (read worker)
- Budgets and cost alerts as alert rule types (alert_rules rebuilt without
  its rule_type CHECK), GET /api/budgets/status, rule preview, spend pace,
  status-bar budget chip; rules stay editable in place
- Query Explorer (/query, allowlisted sort, CSV/JSON export) and scheduled
  reports (report_definitions/report_runs, Settings → Reports)
- Session Replay tab and immutable snapshots (session_snapshots, /snapshot/:token)
- Remote Codex sync, push ingest with a hashed token, privacy redaction and
  ignored folders (Settings → Data), Cursor sessions (no cost)
- Read-only MCP server, statusline, Grafana/Prometheus files

Also: resizable sidebar, pet run/wave animations, the workspace home keeps a
half-typed prompt, and the pre-commit hook runs only the related tests for a
small commit.

server/routes/alerts.js

@@ -9,7 +9,12 @@ const { Router } = require("express");
 const { v4: uuidv4 } = require("uuid");
 const { stmts } = require("../db");
 const { broadcast } = require("../websocket");
-const { RULE_TYPES, validateRuleConfig, invalidateRuleCache } = require("../lib/alerts");
+const {
+  RULE_TYPES,
+  validateRuleConfig,
+  invalidateRuleCache,
+  previewRule,
+} = require("../lib/alerts");
 
 const router = Router();
 
@@ -61,6 +66,30 @@ router.post("/rules", (req, res) => {
   res.status(201).json({ rule: serializeRule(stmts.getAlertRule.get(id)) });
 });
 
+// POST /api/alerts/rules/preview - What a rule WOULD have fired over the last
+// `days` (1–90, default 7) of recorded history. Read-only: nothing is saved,
+// fired or broadcast.
+router.post("/rules/preview", (req, res) => {
+  const { rule_type, config, days, cooldown_seconds } = req.body || {};
+  const validated = validateRuleConfig(rule_type, config);
+  if (!validated.ok) {
+    return res.status(400).json({ error: { code: "INVALID_INPUT", message: validated.error } });
+  }
+  const window = days == null ? 7 : Number(days);
+  if (!Number.isInteger(window) || window < 1 || window > 90) {
+    return res.status(400).json({
+      error: { code: "INVALID_INPUT", message: "days must be an integer in 1..90" },
+    });
+  }
+  const cooldown = cooldown_seconds == null ? 300 : cooldown_seconds;
+  if (!Number.isInteger(cooldown) || cooldown < 0) {
+    return res.status(400).json({
+      error: { code: "INVALID_INPUT", message: "cooldown_seconds must be a non-negative integer" },
+    });
+  }
+  res.json(previewRule(rule_type, validated.config, { days: window, cooldownSeconds: cooldown }));
+});
+
 // PATCH /api/alerts/rules/:id - Update an alert rule (partial)
 router.patch("/rules/:id", (req, res) => {
   const existing = stmts.getAlertRule.get(req.params.id);