#9725 Instrument coderouter usage and failures

Adds privacy-bounded, non-blocking PostHog events for coderouter account/session/model lifecycles; per-user/team streaming token totals and subscription cost basis; Sentry lifecycle breadcrumbs with stronger scrubbing; actionable API errors; and bounded safe-read retries.

Privacy:

• no prompt/output, email, provider account ID, credential, token, header, or body properties
• streaming response remains pass-through with only a bounded rolling tail used to extract aggregate usage
• PostHog delivery uses post-response work, a 2s timeout, and one deduplicated retry

Validation:

• bun run typecheck
• bun test tests/coderouter*.test.ts (43 pass)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Instruments coderouter requests, accounts, and sessions with privacy-safe analytics and Sentry breadcrumbs, and extracts streaming token usage without retaining prompts or outputs. Improves reliability and clarity with safer retries/timeouts and actionable API errors across Codex and OpenCode routing.

• New Features

  • Added PostHog events for account add/remove/status, session issue/revoke, auth rejects, and per-request model completion (grouped by coderouter_team).
  • Extracted usage via observeModelUsage for Codex and OpenCode (model + token counts only; bodies remain pass-through).
  • Returned clearer API errors with human messages, retryable hints, and retry-after where applicable.

• Refactors

  • Introduced addCoderouterBreadcrumb and expanded breadcrumbs across auth, routing, refresh leasing, retries, requests, and analytics delivery with strict scrubbing.
  • Hardened provider interactions: transport failure handling, safe-read retry with breadcrumbs, 5–10s timeouts, and cooldowns on 429.
  • Improved OpenCode proxy: safe provider URL checks, nested model provider rewrite without secrets, and resilient config fetch.
  • Centralized analytics capture with bounded, deferred delivery and one deduplicated retry.
  • Extended route token auth and request context to include stackUserId.

Summary by CodeRabbit

• New Features

  • Added model and token usage tracking for routed requests.
  • Added clearer request status details, including retry guidance for temporary failures.
  • Improved provider routing for nested model APIs.

• Bug Fixes

  • Added timeouts and retry handling for account, provider, credential, and session operations.
  • Improved account and session error responses.
  • Strengthened protection of sensitive request, response, credential, and prompt data.

• Observability

  • Added richer activity and request diagnostics for account, session, provider, and routing operations.