feat: analytics parity — tool cost, date ranges, budgets, query explorer, replay, snapshots (v2.4.0)

Analytics parity phases 2–7 (docs/plans/analytics-parity/), built on
138e706 and ported onto v2.3.1:
- Cost by AI tool (?tool= on cost/analytics/stats/workflows, by_tool,
  Codex fast/priority and flex tiers, agenthub_cost_usd_total{tool,model})
- Date ranges (from/to) on cost/analytics/workflows; Analytics range select
  with Today / This week (Monday) / This month (1st) / 7d / 30d / 90d / All /
  Custom; workflow filters carried into workflow-stats.js (read worker)
- Budgets and cost alerts as alert rule types (alert_rules rebuilt without
  its rule_type CHECK), GET /api/budgets/status, rule preview, spend pace,
  status-bar budget chip; rules stay editable in place
- Query Explorer (/query, allowlisted sort, CSV/JSON export) and scheduled
  reports (report_definitions/report_runs, Settings → Reports)
- Session Replay tab and immutable snapshots (session_snapshots, /snapshot/:token)
- Remote Codex sync, push ingest with a hashed token, privacy redaction and
  ignored folders (Settings → Data), Cursor sessions (no cost)
- Read-only MCP server, statusline, Grafana/Prometheus files

Also: resizable sidebar, pet run/wave animations, the workspace home keeps a
half-typed prompt, and the pre-commit hook runs only the related tests for a
small commit.

server/routes/sessions.js

@@ -338,12 +338,15 @@ router.get("/:id", (req, res) => {
  * All aggregation runs in SQL so we don't ship 14k+ event rows to the client.
  */
 router.get("/:id/stats", (req, res) => {
-  const sessionId = req.params.id;
-  const session = stmts.getSession.get(sessionId);
+  const session = stmts.getSession.get(req.params.id);
   if (!session) {
     return res.status(404).json({ error: { code: "NOT_FOUND", message: "Session not found" } });
   }
+  res.json(sessionStats(req.params.id));
+});
 
+/** The `/:id/stats` body — also frozen into a session snapshot. */
+function sessionStats(sessionId) {
   const totalEvents = stmts.sessionEventCount.get(sessionId)?.count ?? 0;
   const eventsByType = stmts.sessionEventTypeCounts.all(sessionId);
   const tools = stmts.sessionToolUsageCounts.all(sessionId);
@@ -385,7 +388,7 @@ router.get("/:id/stats", (req, res) => {
     else if (row.type === "subagent") agentCounts.subagent = row.count;
   }
 
-  res.json({
+  return {
     session_id: sessionId,
     total_events: totalEvents,
     events_by_type: eventsByType,
@@ -398,8 +401,8 @@ router.get("/:id/stats", (req, res) => {
     agents: agentCounts,
     subagent_types: subagentTypes.filter((r) => r.subagent_type !== "compaction"),
     tokens,
-  });
-});
+  };
+}
 
 router.post("/", (req, res) => {
   const { id, name, cwd, model, metadata } = req.body;
@@ -1096,5 +1099,6 @@ function truncateObj(obj, maxLen) {
 }
 
 module.exports = router;
+module.exports.sessionStats = sessionStats;
 // Exported for unit tests — sender attribution is correctness-critical.
 module.exports.classifyTranscriptSender = classifyTranscriptSender;