port(omniroute): attribute usage to agent sessions and projects #1131

Outcome

Usage already tracks keys/connections. Open OmniRoute proposals add sessions/projects and self-service messages, so review their final design before porting.

Evidence and source state

DurinDoor baseline: 93f6de64c69b17d52f790d6f14d09a74cffc7fa5.

• src/lib/db/repos/usageRepo.js
• omniroute #14833: feat(usage): attribute requests to agent sessions and projects | OPEN
• omniroute #14840: feat(api): add /v1/me/sessions self-service API key endpoints | OPEN
• omniroute #14860: feat(dashboard): team reports for agent sessions by member and project | OPEN
• omniroute #14864: feat(api): add /v1/me/sessions/{id}/messages endpoint with opt-in turn capture | OPEN

Implementation subtasks and acceptance criteria

• Define trusted session/project attribution and limits on header cardinality.
• Keep message capture separately opt-in with retention and redaction.
• Extend reports and self-service endpoints without crossing key scopes.

Dependencies

No hard predecessor. Complete source review and reproduction/discovery before implementation.

Parent epic: #1063. Roadmap: #1056. Priority P2. Stage 3.

Delivery contract

Planning ticket only. No implementation, runtime test, live-provider call, deployment or stored-data mutation was performed in this audit. Before a port, confirm a merged final upstream diff or a reachable source commit, compare local equivalents/tests, and preserve local auth/routing/quota/database contracts. Open upstream work remains a review candidate. Use port(omniroute): title and target a focused PR at bloodf/durindoor:main. Behavior changes require a focused test plus docs. Run npm run lint and cd tests && npm run test:ci; never add baseline failures. Pure docs/CI edits may skip runtime tests. Regenerate registry/agent indexes with their scripts. Preserve stored credentials and unrelated work.