feat: per-tool settings, persistent settings file, Codex and Antigravity sessions, tokens and hooks (#40 B, C1, C2, D)

Part B: Model Pricing, Hook Configuration and CLAUDE_HOME move from
Settings → Dashboard to the Claude Code tab's AgentHub sub-tab
(ClaudeAgentHubSettings.tsx); CODEX_HOME is editable in Codex → AgentHub.
A home that is or contains the OS home is refused (EBADHOME).

Settings persistence: dashboard-saved settings go to
~/.config/agenthub/settings.env (AGENTHUB_SETTINGS_FILE), outside the plugin
cache an update wipes. Load order: real env > the checkout's .env > that file.
The first CLAUDE_HOME change pins DASHBOARD_DATA_DIR so the DB stays put.

C1: codex-usage.js reads Codex rollout journals into sessions (new column
tool) and token_usage, tracked per file in codex_rollouts; forks deduped by
total vector, sub-agent threads folded into the root; pricing-sync also
prices OpenAI models; PricingSettings with a vendor filter.

C2: codex-hooks.js installs AgentHub's hooks into $CODEX_HOME/hooks.json on
a click, through a stable forwarder; Codex trust is never written. The hook
route creates tool='codex' sessions and folds sub-agent hooks into the root.

D: antigravity-usage.js reads agy's per-conversation SQLite files (tokens
from ModelUsageStats) into tool='antigravity' sessions; antigravity-hooks.js
installs the named hook `agenthub` (PreInvocation, PostToolUse, Stop — never
PreToolUse) into ~/.gemini/config/hooks.json; Settings → Antigravity tab;
Gemini pricing.

Whole-change review fixes: sameOriginGuard on both home PUTs, routers.missing
on a CLAUDE_HOME change, reset-pricing scope, GET /api/sessions?tool=,
clear-data covering the new tables, Codex child-thread events moving no
status, hooks owning status only while current, EFOREIGN for a forwarder
that is not ours, agy quiet window and turn rules, AGENTHUB_SETTINGS_FILE
honoured from .env.

Docs, OpenAPI and the CLAUDE.md marker updated. Server 2141, client 779.

server/__tests__/api.test.js

@@ -57,6 +57,7 @@ const EXPECTED_API_PATHS = [
   "/api/settings/export",
   "/api/settings/cleanup",
   "/api/settings/claude-home",
+  "/api/settings/codex-home",
   "/api/import/guide",
   "/api/import/rescan",
   "/api/import/scan-path",
@@ -277,6 +278,20 @@ describe("Sessions API", () => {
     res.body.sessions.forEach((s) => assert.equal(s.status, "active"));
   });
 
+  it("filters sessions by tool, before the limit", async () => {
+    db.prepare(
+      "INSERT INTO sessions (id, name, status, tool, started_at, updated_at) VALUES ('sess-cx', 'cx', 'active', 'codex', '2026-09-29T00:00:00Z', '2026-09-29T00:00:00Z')"
+    ).run();
+    const codex = await fetch("/api/sessions?tool=codex&limit=1");
+    assert.deepEqual(
+      codex.body.sessions.map((s) => s.id),
+      ["sess-cx"]
+    );
+    const claude = await fetch("/api/sessions?tool=claude");
+    assert.ok(claude.body.sessions.length >= 1);
+    assert.ok(claude.body.sessions.every((s) => s.tool === "claude"));
+  });
+
   it("should paginate sessions", async () => {
     const res = await fetch("/api/sessions?limit=1&offset=0");
     assert.equal(res.body.sessions.length, 1);