feat: add explicit cached OpenRouter account analytics

[pacphi]

Closes #59.

What changed

• adds ak usage status as a pure offline cache read
• adds ak usage refresh openrouter as the only explicit network path
• requires OPENROUTER_MANAGEMENT_KEY; inference keys are intentionally not accepted
• validates every official ActivityItem field and atomically stores a credential-free mode-0600 cache
• discards endpoint IDs and every unrecognized/correlation field
• exposes cached OpenRouter account analytics in a separate dashboard block
• keeps OpenRouter-credit usage and BYOK external inference estimates distinct
• preserves transcript-derived session, host, provider, model, project, and task totals unchanged
• documents the evidence boundary in Accepted ADR-0009 and ADR-0016

Discovery result and scope

The supported OpenRouter activity endpoint returns account-level activity for the last 30 completed UTC days. It does not provide a host, local session, project, task, transcript, or correlation key. A third transcript parser would therefore fabricate attribution.

This PR delivers the supported observable scope: explicit provider-account refresh into an offline local cache, visibly separate from transcript analytics. If OpenRouter later publishes a stable identifier also recorded by a host, correlating those streams requires a new evidence decision.

Safety and failure behavior

• ak usage status and dashboard reads make no network request
• --dry-run performs neither network nor writes
• refresh has a 15-second abort budget and 4 MiB response cap
• malformed or partial schema data rejects the entire refresh
• HTTP, schema, JSON, and size failures preserve the last good cache
• the management key is used only in the Authorization header and is never cached or printed

Verification

• pnpm run check — pass
• focused usage/CLI/help tests — 17 pass
• dashboard server/rendering tests — 63 pass
• reviewer re-check — no blockers

A live authenticated refresh was not run because OPENROUTER_MANAGEMENT_KEY is absent on this machine. The fetch contract is covered with injected exact-endpoint/header/schema/atomic-write tests.