feat: analytics parity — tool cost, date ranges, budgets, query explorer, replay, snapshots (v2.4.0)

Analytics parity phases 2–7 (docs/plans/analytics-parity/), built on
138e706 and ported onto v2.3.1:
- Cost by AI tool (?tool= on cost/analytics/stats/workflows, by_tool,
  Codex fast/priority and flex tiers, agenthub_cost_usd_total{tool,model})
- Date ranges (from/to) on cost/analytics/workflows; Analytics range select
  with Today / This week (Monday) / This month (1st) / 7d / 30d / 90d / All /
  Custom; workflow filters carried into workflow-stats.js (read worker)
- Budgets and cost alerts as alert rule types (alert_rules rebuilt without
  its rule_type CHECK), GET /api/budgets/status, rule preview, spend pace,
  status-bar budget chip; rules stay editable in place
- Query Explorer (/query, allowlisted sort, CSV/JSON export) and scheduled
  reports (report_definitions/report_runs, Settings → Reports)
- Session Replay tab and immutable snapshots (session_snapshots, /snapshot/:token)
- Remote Codex sync, push ingest with a hashed token, privacy redaction and
  ignored folders (Settings → Data), Cursor sessions (no cost)
- Read-only MCP server, statusline, Grafana/Prometheus files

Also: resizable sidebar, pet run/wave animations, the workspace home keeps a
half-typed prompt, and the pre-commit hook runs only the related tests for a
small commit.

server/routes/remote-sources.js

@@ -11,6 +11,9 @@
  *   POST   /api/remote-sources/:id/test — probe SSH connectivity
  *   POST   /api/remote-sources/:id/sync — sync now
  *
+ * A source may also pull Codex history (`sync_codex`, opt-in; from
+ * `remote_codex_home`, default ~/.codex) — see syncCodex in remote-sync.js.
+ *
  * No secrets are stored or accepted here — authentication defers entirely to the
  * host's SSH stack. All inputs are validated in remote-sync.validateSourceInput
  * before touching the DB or any command.
@@ -31,6 +34,7 @@ const {
   syncSource,
   syncAllEnabled,
   stagingDir,
+  codexStagingDir,
 } = require("../lib/remote-sync");
 
 const router = Router();
@@ -54,6 +58,8 @@ function serialize(row, sessionCount = 0) {
     ssh_port: row.ssh_port,
     identity_file: row.identity_file,
     remote_home: row.remote_home,
+    sync_codex: !!row.sync_codex,
+    remote_codex_home: row.remote_codex_home ?? null,
     enabled: !!row.enabled,
     status: row.status,
     last_error: row.last_error,
@@ -106,7 +112,9 @@ router.post("/", (req, res) => {
     v.sshPort ?? null,
     v.identityFile ?? null,
     v.remoteHome ?? null,
-    enabled
+    enabled,
+    v.syncCodex ?? 0,
+    v.remoteCodexHome ?? null
   );
   const row = stmts.getRemoteSource.get(id);
   broadcast("remote_source.status", { id, status: row.status });
@@ -147,6 +155,8 @@ router.patch("/:id", (req, res) => {
     v.identityFile !== undefined ? v.identityFile : existing.identity_file,
     v.remoteHome !== undefined ? v.remoteHome : existing.remote_home,
     v.enabled === undefined ? null : v.enabled,
+    v.syncCodex === undefined ? null : v.syncCodex,
+    v.remoteCodexHome !== undefined ? v.remoteCodexHome : existing.remote_codex_home,
     req.params.id
   );
   const row = stmts.getRemoteSource.get(req.params.id);
@@ -176,9 +186,10 @@ router.delete("/:id", (req, res) => {
     db.prepare("UPDATE sessions SET source = 'local' WHERE source = ?").run(req.params.id);
   }
   stmts.deleteRemoteSource.run(req.params.id);
-  // Reclaim the mirrored staging dir.
+  // Reclaim the mirrored staging dirs (Claude projects + Codex sessions).
   try {
     fs.rmSync(stagingDir(req.params.id), { recursive: true, force: true });
+    fs.rmSync(codexStagingDir(req.params.id), { recursive: true, force: true });
   } catch {
     /* non-fatal */
   }