feat: analytics parity — tool cost, date ranges, budgets, query explorer, replay, snapshots (v2.4.0)

Analytics parity phases 2–7 (docs/plans/analytics-parity/), built on
138e706 and ported onto v2.3.1:
- Cost by AI tool (?tool= on cost/analytics/stats/workflows, by_tool,
  Codex fast/priority and flex tiers, agenthub_cost_usd_total{tool,model})
- Date ranges (from/to) on cost/analytics/workflows; Analytics range select
  with Today / This week (Monday) / This month (1st) / 7d / 30d / 90d / All /
  Custom; workflow filters carried into workflow-stats.js (read worker)
- Budgets and cost alerts as alert rule types (alert_rules rebuilt without
  its rule_type CHECK), GET /api/budgets/status, rule preview, spend pace,
  status-bar budget chip; rules stay editable in place
- Query Explorer (/query, allowlisted sort, CSV/JSON export) and scheduled
  reports (report_definitions/report_runs, Settings → Reports)
- Session Replay tab and immutable snapshots (session_snapshots, /snapshot/:token)
- Remote Codex sync, push ingest with a hashed token, privacy redaction and
  ignored folders (Settings → Data), Cursor sessions (no cost)
- Read-only MCP server, statusline, Grafana/Prometheus files

Also: resizable sidebar, pet run/wave animations, the workspace home keeps a
half-typed prompt, and the pre-commit hook runs only the related tests for a
small commit.

server/routes/stats.js

@@ -6,7 +6,7 @@
 const { Router } = require("express");
 const { stmts, db } = require("../db");
 const { getConnectionCount } = require("../websocket");
-const { parseSources } = require("../lib/source-filter");
+const { parseScope, parseTool, BAD_TOOL } = require("../lib/source-filter");
 const scoped = require("../lib/scoped-stats");
 
 const router = Router();
@@ -18,19 +18,21 @@ router.get("/", (req, res) => {
   const toLocal = `${-offsetMin} minutes`; // shift UTC → local
   const toUTC = `${offsetMin} minutes`; // shift local → UTC
 
-  // Data-scope: when the user restricts to a subset of source machines, compute
-  // every count against that subset; otherwise use the cached prepared stmts.
-  const sources = parseSources(req);
-  const overview = sources ? scoped.statsOverview(db, sources) : stmts.stats.get();
-  const agentsByStatus = sources
-    ? scoped.agentStatusCounts(db, sources)
+  // Data-scope: when the user restricts to a subset of source machines and/or
+  // one AI tool, compute every count against that subset; otherwise use the
+  // cached prepared stmts.
+  if (parseTool(req) === false) return res.status(400).json(BAD_TOOL);
+  const scope = parseScope(req);
+  const overview = scope ? scoped.statsOverview(db, scope) : stmts.stats.get();
+  const agentsByStatus = scope
+    ? scoped.agentStatusCounts(db, scope)
     : stmts.agentStatusCounts.all();
-  const sessionsByStatus = sources
-    ? scoped.sessionStatusCounts(db, sources)
+  const sessionsByStatus = scope
+    ? scoped.sessionStatusCounts(db, scope)
     : stmts.sessionStatusCounts.all();
 
-  const eventsToday = sources
-    ? scoped.countEventsToday(db, sources, toLocal, toUTC)
+  const eventsToday = scope
+    ? scoped.countEventsToday(db, scope, toLocal, toUTC)
     : stmts.countEventsToday.get(toLocal, toUTC);
 
   res.json({