feat(desktop): NIP-AM agent-usage backend — P2 emission/transport/archive + P4a aggregation/D6

[wpfleger96]

What

Implements Phases 2 and 4a of the Usage v2 plan (plan events d0268cd0/0e95b035), extending the archive backend to emit, transport, archive, and aggregate both cache categories and billing identity fail-closed.

P2 — emission, transport, archive

Tri-state accumulators (Unseen/Exact/Unknown) for cache-read and cache-write in buzz-agent turn and session state. Absent field = Unknown (never zero) through the full pipeline. Kills the unwrap_or(0) pattern.

Conditional wire emission for accumulatedCachedInputTokens and new accumulatedCacheWriteTokens: fields are omitted when the cumulative is Unseen or Unknown. ACP _goose/unstable/session/update contract documented next to the payload with tests for all absence/zero variants.

PricingIdentity stamping (publisher-side):

• pricing_authority(): canonical parsed-URL endpoint comparison against the official allowlist — HTTPS only, exact allowlisted host (lookalike-safe), default port, required API base path, rejects userinfo/query/fragment/path-prefix lookalikes. Wire token is the NIP-AM bare-host registry identifier (api.anthropic.com, api.openai.com, openrouter.ai).
• Model: the actually-requested request_model after mesh/auto resolution (not effective_model_str).
• Turn discipline: identity retained only while ALL usage in the current turn carries one identical proven identity; any mismatch, unproven-usage-bearing response, or unpaired cumulative snapshot poisons to absent; a later matching notification does not heal a mixed turn.

M3 migration: adds turn_cache_write_tokens, cumulative_cache_write_tokens, pricing_authority, pricing_model, pricing_cache_class to agent_metric_index. Additive, idempotent, guarded by marker. Fresh-DB schema includes all M3 columns.

P4a — aggregation layer

Extended S-1 ladder to cache-read and cache-write via the same ladder_token path as the existing token fields.

freshInputTokens derivation: checked arithmetic, fail-closed — absent cache fields produce Unknown (not zero), overflow and cacheRead+cacheWrite > input both produce incomplete: true. Aggregated as a UsageField.

D6 comparator: sort_value() = provider total when known, else input+output when both known, else None (unknown-last). Replaces the prior total-only comparator for both agent-level and model-level sort. Ships a pinned test vector that the TS render layer (P5) must match.

Test coverage

• buzz-agent: 394 tests (pricing_authority, turn discipline, cache tri-state, wire emission)
• buzz-acp: 9 tests (identity threading, cache fields)
• Desktop (Rust): 2256 tests — includes 14 new P4a pinned tests (agent_usage_p4a_tests.rs): cache ladder, fresh-input fail-closed cases (missing slice, overflow, subset > input), D6 comparator vector

Related PRs

• P1 NIP-AM spec: #4632
• P3 pricing table: #4629
• UI (P5): #4001