#634 feat(api): add credit-spend visibility digest cron

Adds a Vercel Cron (*/10 * * * *) that hits GET /api/internal/credit-spend-digest, aggregates usage_events spend over the last 10 minutes via the get_credit_spend_digest Postgres function, and posts a top-spenders summary to Telegram (total spend, turns, tokens, tool calls, main-vs-subagent split, per-model breakdown). Empty window is a no-op. Cron-only via a CRON_SECRET bearer check. Implements the digest item from chat#1767.

Requires the get_credit_spend_digest function (recoupable/database#28) and a CRON_SECRET env var.

Test plan

• npx vitest run lib/internal/credit-spend-digest — 14 tests green (formatter, validator, handler).
• On the Vercel preview: GET /api/internal/credit-spend-digest with Authorization: Bearer $CRON_SECRET returns {sent:false} for an empty window and posts to Telegram when there is recent spend; without the bearer returns 401.

---

Summary by cubic

Adds a Vercel Cron that calls GET /api/internal/credit-spend-digest every 10 minutes to post a top-spenders credit-spend digest to Telegram. Refactors the digest modules into lib/credits, surfaces cached input tokens as an informational note (no double-count), and standardizes the misconfig 500 body.

• New Features

  • Internal endpoint with auth validator and no-cache; aggregates last 10m via get_credit_spend_digest and sends a Telegram message (implements chat#1767). Empty windows are a no-op.
  • Per account: total spend, turns, tokens (cached shown separately), tool calls, main vs subagent, and per-model breakdown; top 10 accounts.
  • Scheduled in vercel.json with */10 * * * *.

• Migration

  • Deploy Postgres function get_credit_spend_digest (recoupable/database#28).
  • Set CRON_SECRET in Vercel and ensure the cron includes Authorization: Bearer $CRON_SECRET; if the value was corrected, redeploy to pick it up (missing secret returns 500, unauthorized returns 401).

Summary by CodeRabbit

• New Features
  • Added internal credit spend digest endpoint with automated processing and reporting capabilities.
  • Added formatting utilities for currency conversion and token display.
  • Implemented request validation for secure cron-based access to internal endpoints.