fix(analytics): accurate log/cost reporting and always-on cost display

[8nevil8]

Summary

Fixes analytics-reporting accuracy gaps in codemie analytics and adds token-usage propagation to CodeMie's live session metrics for anthropic-subscription (and, more broadly, any claude-agent) sessions, so the backend can derive accurate cost/usage figures server-side.

Changes

Analytics accuracy (original scope)

• hadLog correctness: loadAgentSessionFile now verifies the correlated/native transcript path still exists on disk before treating a session as hadLog=true. A coding agent's own retention (e.g. Claude Code's default 30-day cleanup) can rotate a transcript away after the session ran while the correlation record still names it — 122 of 291 real Claude sessions in one report were misreported this way.
• Ownership marker scan window: hasOwnershipMarker's legacy-session scan widened from a 4KB/10-line budget to a 256KB byte-bounded scan, now with a full-file fallback past that budget so a larger hookAdditionalContext blob can't reproduce the same misclassification at a higher threshold.
• Active duration + always-on cost: sessions now surface CodeMie's own tracked activeDurationMs alongside the existing wall-clock duration. Cost enrichment now always runs for the plain console command, not just --report. --export json/--export csv now include cost and active-duration data consistent with the console output.
• Test cleanup: the skills-setup integration test's Global scope installs into the real ~/.claude/skills/ and never cleaned that up — now removed in afterAll.

Live metrics token propagation (new scope)

• MetricDelta gains a tokens field ({ input, output, cacheRead?, cacheCreation? }), captured by claude.metrics-processor.ts from the Anthropic usage object on every completed turn — previously read only to detect stream completion and discarded. Numeric fields are coerced defensively (Number(...) || 0).
• Live /v1/metrics payload (SessionLifecycleAttributes, ToolUsageAttributes) gains four new flat, optional, snake_case fields: input_tokens, output_tokens, cache_read_tokens, cache_creation_tokens — additive only, never a dict/map shape, to stay compatible with the backend's documented behavior of silently dropping payloads containing unrecognized/dict-shaped fields. ToolUsageAttributes carries incremental since-last-sync totals; SessionLifecycleAttributes carries whole-session cumulative totals.
• No cost is ever computed or sent by the client — only raw token counts, same pattern as the existing Codex integration.
• MetricsSender.sendSessionEnd gains new optional trailing parameters (mirroring the existing activeDurationMs precedent); DesktopTelemetryRuntime's session-end path now also sums and sends token totals, matching the CLI hook path.
• Resilience: MetricsWriter.readAll() now skips a single malformed metrics-delta line instead of aborting the entire session-end metrics send.
• Debug-log and dry-run projections in MetricsApiClient now include the four new token fields.
• Statusline: the Claude Code statusline now shows cumulative session token totals (input/output/cache) read from the metrics-delta file, alongside the existing live context-window snapshot.

Testing

• Unit/integration tests added for each fix and each new capture/propagation path (token coercion, corrupt-delta handling, desktop-telemetry parity, native-loader fallback, export column coverage, activeDurationMs passthrough, cost-enrichment on the plain path)
• npm run typecheck, lint, and secrets scan passed via pre-commit hooks on each commit
• Full qa-gates run (license-check, lint, typecheck, build, unit, integration, secrets, commitlint) passed

Checklist

• Code follows project standards
• CI is green (npm run ci)
• No merge conflicts with main