feat: analytics parity — tool cost, date ranges, budgets, query explorer, replay, snapshots (v2.4.0)

Analytics parity phases 2–7 (docs/plans/analytics-parity/), built on
138e706 and ported onto v2.3.1:
- Cost by AI tool (?tool= on cost/analytics/stats/workflows, by_tool,
  Codex fast/priority and flex tiers, agenthub_cost_usd_total{tool,model})
- Date ranges (from/to) on cost/analytics/workflows; Analytics range select
  with Today / This week (Monday) / This month (1st) / 7d / 30d / 90d / All /
  Custom; workflow filters carried into workflow-stats.js (read worker)
- Budgets and cost alerts as alert rule types (alert_rules rebuilt without
  its rule_type CHECK), GET /api/budgets/status, rule preview, spend pace,
  status-bar budget chip; rules stay editable in place
- Query Explorer (/query, allowlisted sort, CSV/JSON export) and scheduled
  reports (report_definitions/report_runs, Settings → Reports)
- Session Replay tab and immutable snapshots (session_snapshots, /snapshot/:token)
- Remote Codex sync, push ingest with a hashed token, privacy redaction and
  ignored folders (Settings → Data), Cursor sessions (no cost)
- Read-only MCP server, statusline, Grafana/Prometheus files

Also: resizable sidebar, pet run/wave animations, the workspace home keeps a
half-typed prompt, and the pre-commit hook runs only the related tests for a
small commit.

server/routes/workflows.js

@@ -7,6 +7,7 @@ const { Router } = require("express");
 const { db, stmts } = require("../db");
 const { runRead } = require("../lib/read-pool");
 const { WORKFLOW_SECTIONS, sessionIdFilter } = require("../lib/workflow-stats");
+const { parseTool, BAD_TOOL, parseRange, BAD_RANGE } = require("../lib/source-filter");
 
 const router = Router();
 
@@ -15,8 +16,14 @@ const router = Router();
 // large database, which inline would stall every other request meanwhile.
 // `?sections=a,b` computes only those parts of it (System Health needs seven).
 router.get("/", async (req, res) => {
-  // Optional status filter: "active", "completed", or omit for all
+  // Optional filters: status ("active", "completed", or omit for all), the AI
+  // tool (`?tool=`, `sessions.tool`) and `?from=&to=` (sessions started in
+  // those local days).
   const statusFilter = req.query.status || null;
+  const tool = parseTool(req);
+  if (tool === false) return res.status(400).json(BAD_TOOL);
+  const range = parseRange(req);
+  if (range === false) return res.status(400).json(BAD_RANGE);
   let sections = null;
   if (typeof req.query.sections === "string") {
     sections = req.query.sections.split(",").filter((k) => WORKFLOW_SECTIONS.includes(k));
@@ -30,7 +37,7 @@ router.get("/", async (req, res) => {
     }
   }
   try {
-    res.json(await runRead("workflows", { status: statusFilter, sections }));
+    res.json(await runRead("workflows", { status: statusFilter, tool, range, sections }));
   } catch (err) {
     if (err.code === "EREADTIMEOUT") {
       return res.status(503).json({ error: { code: err.code, message: err.message } });
@@ -54,7 +61,11 @@ router.get("/", async (req, res) => {
  */
 router.get("/skill-usage", (req, res) => {
   try {
-    const sf = sessionIdFilter(req.query.status || null);
+    const tool = parseTool(req);
+    if (tool === false) return res.status(400).json(BAD_TOOL);
+    const range = parseRange(req);
+    if (range === false) return res.status(400).json(BAD_RANGE);
+    const sf = sessionIdFilter({ status: req.query.status || null, tool, range });
 
     const skills = db
       .prepare(