feat: split token counters and hour-resolution usage history

Data layer for the upcoming Vue admin charts (v0.2 data-layer task).

Tokens-in/out split (limits.go): metricTok replaced by metricTokIn
("tokin") and metricTokOut ("tokout"). account() records usage.prompt
and usage.completion independently, skipping a direction only when its
own value is zero. A TokensPerDay/TokensPerMonth limit still enforces
one TOTAL budget: tokenBudgetViolation reads both counters in one
storeGetMulti batch and sums them; the violation message still says
"tokens". Estimated usage (the request-body-size fallback) lands
entirely in tokin, documented at its call site.

Hour window (limits.go): windowHour ("hour"), bucket format
"2006010215" UTC, hourWindowTTL (48h). checkAndCount/account both write
it on every metered route; no LimitsConfig field ever names it, so
evaluateScope never evaluates it. dayWindowTTL/monthWindowTTL bumped to
35d/400d so the usage-history API's largest span always finds a live
key.

Total scope (limits.go, routes_unified.go): a synthetic
{kind:"total", id:"all"} scope, limits always nil. withTotalScope
wraps buildLimitScopes' result at every metered route (unified,
media, passthrough, mcp/a2a) so none can forget it; handleAdminAPI's
own accounting stays on buildLimitScopes alone, so admin traffic never
contributes to it.

History API (admin.go): GET /admin/api/usage/history?scope=&metric=&
window=&span= — admin-gated like the other two JSON routes, but
skips checkAndCount ahead of that same change landing for every
/admin/api/* route in a later task. Validates scope kind/metric/window
(400), span bounds per window (400), and unknown user/group id (404).
Computes every bucket key up front and reads them in ONE storeGetMulti
batch; a storeDown read is 503, never a silently-zero series. Works
against memoryStore too.

Admin usage API (admin.go): scopeUsage/adminUsageEntryView now expose
tokensInPerDay/tokensOutPerDay and their per-month counterparts in
place of the combined tokensPerDay/tokensPerMonth pair; buildAdminUsage
adds a "total" row to the response, still one storeGetMulti round trip
overall. usageKeysPerScope names the per-scope key stride (was a bare
6, now 8), closing a deferred review follow-up while the count changed
anyway.

Tests: TDD throughout — bucket/window-key math incl. UTC and hour
boundaries, the month step-back day-31 AddDate trap, split accounting,
token budget summing both directions, total-scope counting-without-
evaluating on every metered route, and the full history API (shape,
oldest-first, span bounds, validation table, 404, 503, one-batch
assertion via a counting stub). Integration: TestAdminDashboard now
fetches an hour history series for user alice and for total and
asserts a non-zero current-hour bucket.

Migration: none — old "tok" counter keys simply expire on their
existing TTL; nothing is deployed yet.

routes_unified.go

@@ -113,7 +113,7 @@ func (g *Gateway) runUnified(w http.ResponseWriter, r *http.Request, u *user, gr
 		return
 	}
 
-	scopes := buildLimitScopes(u, grp)
+	scopes := withTotalScope(buildLimitScopes(u, grp))
 	if violation := g.limiter.checkAndCount(scopes); violation != nil {
 		writeLimitViolation(sw, violation)
 		return
@@ -225,6 +225,12 @@ func (g *Gateway) runUnified(w http.ResponseWriter, r *http.Request, u *user, gr
 // apply to a given request. The user scope is listed first, so
 // checkAndCount reports a user's own violation ahead of their group's when
 // both are breached by the same request.
+//
+// Callers metering actual LLM traffic wrap this result in withTotalScope
+// before passing it to checkAndCount/account; handleAdminAPI (admin.go)
+// calls this directly, without withTotalScope, so an admin request's own
+// req/min-req/day accounting never contributes to the total-scope
+// LLM-traffic series (v0.2 data-layer task).
 func buildLimitScopes(u *user, grp *group) []limitScope {
 	scopes := make([]limitScope, 0, 2)
 	if u.limits != nil {
@@ -236,6 +242,20 @@ func buildLimitScopes(u *user, grp *group) []limitScope {
 	return scopes
 }
 
+// withTotalScope returns scopes with the synthetic total scope
+// (totalScopeKind/totalScopeID, limits.go) appended — the single helper
+// every metered route (runUnified above; resolveMediaRequest,
+// routes_media.go; handlePassthrough, routes_passthrough.go;
+// handleTargetProxy, mcp_a2a.go) calls around its own buildLimitScopes
+// result, so none of them can forget it and none of them duplicate the
+// scope literal. Deliberately not folded into buildLimitScopes itself:
+// that helper is also called directly by handleAdminAPI (admin.go) for
+// its own req/min-req/day accounting, and admin traffic must never
+// contribute to the total LLM-traffic scope.
+func withTotalScope(scopes []limitScope) []limitScope {
+	return append(scopes, limitScope{kind: totalScopeKind, id: totalScopeID, limits: nil})
+}
+
 // unifiedCostMicros resolves the price to charge one request's usage
 // against: canonical ("provider/model") first, falling back to bare — the
 // upstream model id alone — only when canonical has no configured price at