feat: per-tool settings, persistent settings file, Codex and Antigravity sessions, tokens and hooks (#40 B, C1, C2, D)

Part B: Model Pricing, Hook Configuration and CLAUDE_HOME move from
Settings → Dashboard to the Claude Code tab's AgentHub sub-tab
(ClaudeAgentHubSettings.tsx); CODEX_HOME is editable in Codex → AgentHub.
A home that is or contains the OS home is refused (EBADHOME).

Settings persistence: dashboard-saved settings go to
~/.config/agenthub/settings.env (AGENTHUB_SETTINGS_FILE), outside the plugin
cache an update wipes. Load order: real env > the checkout's .env > that file.
The first CLAUDE_HOME change pins DASHBOARD_DATA_DIR so the DB stays put.

C1: codex-usage.js reads Codex rollout journals into sessions (new column
tool) and token_usage, tracked per file in codex_rollouts; forks deduped by
total vector, sub-agent threads folded into the root; pricing-sync also
prices OpenAI models; PricingSettings with a vendor filter.

C2: codex-hooks.js installs AgentHub's hooks into $CODEX_HOME/hooks.json on
a click, through a stable forwarder; Codex trust is never written. The hook
route creates tool='codex' sessions and folds sub-agent hooks into the root.

D: antigravity-usage.js reads agy's per-conversation SQLite files (tokens
from ModelUsageStats) into tool='antigravity' sessions; antigravity-hooks.js
installs the named hook `agenthub` (PreInvocation, PostToolUse, Stop — never
PreToolUse) into ~/.gemini/config/hooks.json; Settings → Antigravity tab;
Gemini pricing.

Whole-change review fixes: sameOriginGuard on both home PUTs, routers.missing
on a CLAUDE_HOME change, reset-pricing scope, GET /api/sessions?tool=,
clear-data covering the new tables, Codex child-thread events moving no
status, hooks owning status only while current, EFOREIGN for a forwarder
that is not ours, agy quiet window and turn rules, AGENTHUB_SETTINGS_FILE
honoured from .env.

Docs, OpenAPI and the CLAUDE.md marker updated. Server 2141, client 779.

server/lib/lanes.js

@@ -790,7 +790,9 @@ function subdirLikePattern(cwd) {
 
 /**
  * Find sessions that belong to a lane and may be purged: exact or subdirectory,
- * excluding the lane's bound session and any active sessions. Shared between
+ * recorded by the lane's own tool (a Claude and a Codex lane can share one
+ * directory, and purging one must not take the other's history), excluding
+ * the lane's bound session and any active sessions. Shared between
  * purgeLaneSessions (the deleter) and preflight counting, so the confirmation
  * dialog's numbers match what actually gets deleted.
  */
@@ -799,10 +801,11 @@ function purgeCandidateSessions(lane) {
     .prepare(
       `SELECT id FROM sessions
      WHERE (cwd = ? OR cwd LIKE ? ESCAPE '${SUBDIR_LIKE_ESCAPE}')
+       AND tool = ?
        AND id != ?
        AND status != 'active'`
     )
-    .all(lane.cwd, subdirLikePattern(lane.cwd), lane.session_id || "");
+    .all(lane.cwd, subdirLikePattern(lane.cwd), lane.tool || "claude", lane.session_id || "");
 }
 
 /**
@@ -816,10 +819,11 @@ function hasActiveLaneSession(lane) {
     .prepare(
       `SELECT COUNT(*) AS count FROM sessions
      WHERE (cwd = ? OR cwd LIKE ? ESCAPE '${SUBDIR_LIKE_ESCAPE}')
+       AND tool = ?
        AND id != ?
        AND status = 'active'`
     )
-    .get(lane.cwd, subdirLikePattern(lane.cwd), lane.session_id || "");
+    .get(lane.cwd, subdirLikePattern(lane.cwd), lane.tool || "claude", lane.session_id || "");
   return Boolean(row && row.count > 0);
 }