Record what every model call spends, and show it

Nothing anywhere recorded what a model call cost: the harness used a
provider's usage numbers only to decide whether a turn had finished, then
dropped them. So a reply could not say what it took to make, one model
could not be compared with another on price, and there was no way to ask
what a day, a week or a month of the crew's work came to.

- `token_usages` records one row per call: user, bot, workspace, session,
  job and message, the harness, the provider and model that actually
  answered, the prompt and completion counts, and the cost when the
  provider reports one.
- `harness-usage-scope.ts` carries those ids in an AsyncLocalStorage
  scope that `run-bot-job.ts` enters once, so a run's turns, its session
  summary, its transcriptions, images and embeddings are all attributed
  without threading ids through every harness function. Nested runs merge
  rather than replace, and a null genuinely clears a field (a bot's own
  chat has no workspace).
- Work with no run behind it is charged to its owner instead:
  `run-with-fallback-scope.ts` reaches the workspace's creator else the
  bot's, and deliberately does not override a real run, so an ingest a
  bot asked for is not misattributed to the bot's owner.
- All six harnesses record through `withCandidates`'s `on_success`.
  Recording never throws: a model that answered must not lose its answer
  to a failed insert.
- A job's calls land before its message exists, so `complete-bot-job.ts`
  back-fills `message_id` once the message is inserted.
- The message's actions row shows what it cost, beside the timestamp and
  the play button, with the breakdown in its title.
- `/admin/usage` totals the install's spending for 7, 30 or 90 days: the
  total against the previous period, a day-by-day chart, a split per kind
  of call, and a table per model with the price per thousand tokens
  worked out from cost and tokens, which is what makes two models
  comparable. Crew managers only, since it is the whole install's work
  rather than one user's conversation. It sits with Routines and Activity
  in the user popover rather than under Settings, because it is a record
  of what happened, not something to configure.

Days are grouped in local time (`date(created_at / 1000, 'unixepoch',
'localtime')`), matching the local midnights the window builds and the
`YYYY-MM-DD` buckets it looks up. Grouping by the bare UTC day put a late
evening's calls under a name no bucket carried, so they vanished and the
chart's total silently disagreed with the totals card; a test pins it.

`canSeeRailItem` now decides who sees a popover or rail entry. The two
each filtered with their own inline rule and only one understood
`can_view`, so a gated page could be offered in the popover to everyone.

src/functions/backend/db/bot-files/ingest-bot-file.ts

@@ -7,6 +7,10 @@ import type {
 import { AppData } from "@/src/data/app-data";
 import embedText from "@/src/harness/embeddings/embed-text";
 import HarnessError from "@/src/harness/harness-error";
+import { grabHarnessUsageScope } from "@/src/harness/usage/harness-usage-scope";
+import type { HarnessUsageScope } from "@/src/harness/usage/types";
+import runWithFallbackScope from "@/src/harness/usage/run-with-fallback-scope";
+import grabUsageOwnerUserId from "@/src/functions/backend/db/usage/grab-usage-owner";
 import chunkText from "./chunk-text";
 import extractBotFileText from "./extract-bot-file-text";
 
@@ -72,13 +76,27 @@ export default async function ingestBotFile({
         return { status: "skipped", chunks: 0 };
     }
 
+    /**
+     * A bot's own run already carries its user. The ingest queue has no run
+     * behind it, so everything this file costs - reading an image or an
+     * audio file, embedding its chunks - is entered under the owner's scope
+     * instead: it spends real tokens and must show on the usage page.
+     */
+    const owner_scope: HarnessUsageScope | null = grabHarnessUsageScope()?.user_id
+        ? null
+        : await resolveOwnerScope({ file });
+
     try {
-        const text = await extractBotFileText({
-            write_path: media?.media_write_path,
-            text_content: media?.text_content,
-            name: file.name,
-            mime_type: file.mime_type,
-            read_media,
+        const text = await runWithFallbackScope({
+            scope: owner_scope,
+            task: () =>
+                extractBotFileText({
+                    write_path: media?.media_write_path,
+                    text_content: media?.text_content,
+                    name: file.name,
+                    mime_type: file.mime_type,
+                    read_media,
+                }),
         });
 
         await clearChunks({ file_id: file.id });
@@ -107,11 +125,11 @@ export default async function ingestBotFile({
              */
             for (let start = 0; start < chunks.length; start += AppData.EmbeddingBatchSize) {
                 const batch = chunks.slice(start, start + AppData.EmbeddingBatchSize);
-                const { vectors } = await embedText({
-                    input: batch,
-                    bot_id: file.bot_id!,
-                    workspace_id: file.scope == "workspace" ? file.owner_id : null,
+                const { vectors } = await runEmbed({
+                    scope: owner_scope,
                     signal,
+                    file,
+                    batch,
                 });
 
                 for (let i = 0; i < vectors.length; i++) {
@@ -252,3 +270,54 @@ async function markIngested({
         values: [chunks > 0 ? 1 : 0, now, file_id],
     }).catch(() => {});
 }
+
+/**
+ * One batch of a file's chunks, embedded under whatever attribution owns
+ * it: the run that asked for the ingest, else the file's owner.
+ */
+async function runEmbed({
+    scope,
+    signal,
+    file,
+    batch,
+}: {
+    scope: HarnessUsageScope | null;
+    signal?: AbortSignal;
+    file: BUN_SQLITE_COBBLE_BOT_FILES;
+    batch: string[];
+}) {
+    return await runWithFallbackScope({
+        scope,
+        task: () =>
+            embedText({
+                input: batch,
+                bot_id: file.bot_id!,
+                workspace_id: file.scope == "workspace" ? file.owner_id : null,
+                signal,
+            }),
+    });
+}
+
+/**
+ * The attribution a file the queue ingests reports under: its workspace's
+ * creator when it shares one, else its bot's.
+ */
+async function resolveOwnerScope({
+    file,
+}: {
+    file: BUN_SQLITE_COBBLE_BOT_FILES;
+}): Promise<HarnessUsageScope | null> {
+    const workspace_id = file.scope == "workspace" ? file.owner_id : null;
+    const user_id = await grabUsageOwnerUserId({ bot_id: file.bot_id, workspace_id });
+
+    if (!user_id) return null;
+
+    return {
+        user_id,
+        bot_id: file.scope == "bot" ? file.owner_id : file.bot_id,
+        workspace_id,
+        session_id: null,
+        message_id: null,
+        job_id: null,
+    };
+}