Add secure scoped usage reporting

[deltawi]

Closes #241

What changed

• adds configurable Usage reporting periods for last week, 30 days, 3 months, 6 months, year to date, all time, and custom dates
• rebuilds the usage overview and owner/model breakdown around consistent spend and token measures
• gives regular users a self-scoped Usage view, partitioned by their organizations or teams with a model drill-down
• records immutable platform-account ownership on spend and batch events so personal usage cannot be forged through caller metadata
• adds explicit platform, organization, team, and self reporting predicates and keeps request logs and user/API-key dimensions restricted
• adds cursor pagination, adaptive time buckets, cache refresh coordination, bounded reporting concurrency, database admission control, statement timeouts, and supporting indexes
• documents the feature-flagged rollout, readiness checks, migrations, and legacy unattributed-row behavior

Why

The existing Usage page could not reliably answer where spend occurred or which models drove it, and regular users had no safe view of their own usage. Reporting also needed safeguards so analytical queries cannot pressure gateway database capacity.

This implements the issue end to end while retaining a clean UI and keeping the security boundary in server-side SQL predicates.

User and developer impact

• administrators can inspect usage by organization, team, user, and model using USD or token measures
• regular members can see only usage owned by their account, split across their current organizations and teams
• self-scoped users cannot access request logs, tenant-wide rankings, user grouping, or API-key grouping
• model drill-downs require an authorized selected scope and retain the original visibility predicate
• deployment remains gated by spend_reporting_v2_enabled until migrations and fleet readiness are confirmed

Validation

• uv run pytest -q: 2,711 passed, 121 skipped
• npm run test:unit in ui/: 101 passed
• npm run build in ui/: passed
• targeted Ruff checks: passed
• git diff --check: passed
• Docker deployment and seeded multi-organization self-usage flows were exercised on port 4002 before rebasing