feat(admin): add fleet statistics and admin read endpoints

Counters (always on when admin is enabled):
- last seen per user and group, written asynchronously after
  admission, throttled to one write per scope per minute per replica
- hourly provider and model attempts, failures and timeouts
- failovers per provider, rejections per hour, and unpriced (402)
  refusals
- cache hits, misses and cost saved
- request counts per target and caller

Opt-in counters under admin.stats (both default off):
- userModel: usage per user and model
- latency: latency histograms per provider and model

All counters ride the existing Redis batches. A test measures three
round trips per request with defaults and with every statistic on. A
cache hit takes two. A model request is no longer counted for failed
failover candidates.

New admin endpoints:
- usage/series and usage/totals
- performance, with percentiles from the histograms
- catalog, with the price billing actually uses and its source
- consumers, with key source, grants and model access
- config, with secrets redacted

The overview gains features and a pricing summary. Usage gains
lastSeen. usage/models gains offset and more detail fields. Reads are
chunked at 1600 keys per round trip and capped at 64000 keys per
request.

Claude-Session: https://claude.ai/code/session_01V5jYJNxpDFdJkyyExpADrv

resp_test.go

@@ -46,6 +46,18 @@ func TestPipelineMutates_LPUSH(t *testing.T) {
 	}
 }
 
+// encodeCommand renders args as a RESP2 command array:
+// "*N\r\n$len\r\narg\r\n..." for each arg — encodeCommands' (resp.go)
+// single-command special case. No production call site needs a
+// one-command string result on its own (every real caller batches
+// through encodeCommands), so this stays as a test-only helper
+// (admin-redesign WP-G cleanup) purely to keep TestEncodeCommand's
+// single-command wire-format pin readable without a slice-of-slice
+// literal at every call site.
+func encodeCommand(args []string) string {
+	return string(encodeCommands([][]string{args}))
+}
+
 // TestEncodeCommand pins the exact RESP2 wire format every command must
 // use: "*N\r\n$len\r\narg\r\n..." — a fake or real server parses this
 // framing byte-for-byte, so a drift here breaks every other test silently.