fix(webui): keep charts consistent with the current selection

Chart and ranking fetches carry a request id, and a superseded response
is dropped. Changing a selection clears the old data at once, so old
numbers never show under new labels or units. The auto-refresh tick
skips while a fetch is still in flight. "Loading..." shows only until
the first result for a selection arrives. Dashboard polls do not
overlap.

Users in several groups are counted and searched in every group. The
Models tab labels its windows as the current UTC bucket. Hour labels
are marked UTC. The Members column sorts numerically. Target access
shows "All groups" for null and "No groups" for []. The UI shows the
server's own error message. Cost axis ticks use the currency
formatter. npm run dev proxies /admin/api. Nine unused shadcn
components are removed.

admin_assets_gen.go is regenerated from the new build.

Claude-Session: https://claude.ai/code/session_01V5jYJNxpDFdJkyyExpADrv

webui/src/types/api.ts

@@ -231,6 +231,17 @@ export interface AdminUsageEntryView {
   kind: string
   id: string
   groupName?: string
+  /**
+   * The user's full member group list (multi-group support, admin.go's
+   * adminUsageEntryView.Groups) — set only on a user entry, same "user-only"
+   * convention groupName above already follows. groupName keeps the FIRST
+   * group for back-compat; groups is the complete membership. Every
+   * group-membership check (search matching, the members table, the Group
+   * column) must read `entry.groups ?? [entry.groupName]`, never groupName
+   * alone — a multi-group user otherwise silently drops out of every group
+   * but their first.
+   */
+  groups?: string[]
   /**
    * The group's configured access lists (admin.go: adminUsageEntryView's
    * Providers/Models/MCPServers/Agents) — set only on a group entry (kind
@@ -357,14 +368,14 @@ export interface AdminTargetHealthView {
  * One configured MCP server's or A2A agent's row in GET /admin/api/targets
  * (admin.go: adminTargetView). Access is the group names actually allowed
  * to reach this target, computed server-side via the same matching authz
- * enforcement uses — undefined/empty means every configured group can
- * reach it ("empty meaning all", mirroring AdminUsageEntryView's own
- * providers/models/mcpServers/agents convention above).
+ * enforcement uses — null/undefined means every configured group can
+ * reach it, [] means no configured group can, and a non-empty list names
+ * the groups that can (admin.go adminTargetView.Access).
  */
 export interface AdminTargetView {
   name: string
   url: string
-  access?: string[]
+  access?: string[] | null
   counters: AdminTargetCountersView
   /** See AdminTargetHealthView's own doc comment (feat/target-health) — always present, unlike access above. */
   health: AdminTargetHealthView