feat(usage): attribute Sources rows to user accounts in admin view

[localai-bot]

Follow-up to #9920.

Problem

Admin Sources tab in #9920 shows per-API-key and per-source totals, but:

• Each named-key row only shows the key label - admins can't tell which user owns the key.
• All users' Web UI session traffic is lumped into a single global "Web UI" row.

Even though every UsageRecord carries user_id/user_name, the
by_key roll-up dropped those fields, and by_source only grouped
by source class.

Change

Backend (core/http/auth/usage.go):

• KeyTotal gains UserID + UserName. by_key now groups by
  (api_key_id, api_key_name, user_id, user_name).
• New SourceTotals.ByUserSource []UserSourceTotal roll-up groups
  (source, user_id, user_name) for sources without a key identity
  (web, legacy). Populated only on the admin path
  (includeLegacy=true); the non-admin endpoint stays unchanged for
  backwards compatibility.

Frontend (SourcesTable.jsx):

• New showUserColumn prop (admin-only). Renders a User column,
  extends search to match user name/id, and expands the Web UI /
  Legacy pseudo-rows from one global row to one row per user using
  by_user_source.

i18n: adds usage.sources.sortUser = "User".

Test plan

• ginkgo -tags auth ./core/http/auth/ - 150/150 pass (3 new specs)
• go test -tags auth ./core/http/middleware/... - clean
• ginkgo -tags auth ./core/http/routes/ - 63/63 pass
• go vet -tags auth ./core/http/... - clean
• npm run build in core/http/react-ui/ - clean
• Manual smoke: admin Sources tab shows User column on every row
• Manual smoke: admin Web UI traffic shows per-user rows
• Manual smoke: non-admin Sources tab unchanged (no User column)
• Manual smoke: search input matches user names/emails