feat(api): add an optional cost dimension to product-usage events

[JSONbored]

Summary

• Closes Add a cost dimension to product-usage events #4918: adds a nullable `cost_usd` column to `product_usage_events`, threaded through `recordProductUsageEvent`. Distinct from `ai_usage_events.costUsd` (the detailed, authoritative AI-spend ledger with tokens/model/provider) — this is a lightweight, optional summary figure any surface can attach to its own usage row when it knows a per-event cost, without requiring a join.
• Normalization mirrors the existing `normalizeProductUsageLatency` helper exactly: a non-number/non-finite value degrades to `null` (no cost recorded), a negative number floors to `0` — same defensive shape as the sibling field already in this file.
• Null/unset by default — the vast majority of product actions (viewed a page, ran a preview) have no direct cost, and every existing caller of `recordProductUsageEvent` is unaffected.

Closes #4918

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves.

Validation

• git diff --check
• npm run db:migrations:check — 169 migrations OK, contiguous through 0165.
• npm run db:schema-drift:check — no drift.
• npm run typecheck
• npm run test:coverage locally, full unsharded run: 990 test files / 18487 tests passed, 0 failures.
• npm run ui:openapi:check — no drift.
• npm audit --audit-level=moderate — one pre-existing high-severity finding (adm-zip via github-actionlint, no fix available), unrelated to this change.
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries — 3 new tests: recording a real cost, defaulting to null when omitted (regression-pins byte-identical behavior for every existing caller), and normalizing a negative (floors to 0) vs. non-finite (nulls) value — both branches of the new helper covered.

Skipped (not applicable): npm run actionlint, npm run test:workers, npm run build:mcp, npm run test:mcp-pack, npm run ui:lint, npm run ui:typecheck, npm run ui:build — no .github/workflows/**, Workers-binding, mcp-package, or apps/loopover-ui/** changes in this diff.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests — N/A, no such changes.
• API/OpenAPI/MCP behavior is updated and tested where needed — N/A, internal telemetry-recording function, not a public API surface.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks — N/A, backend-only.
• Visible UI changes include a UI Evidence section — N/A, no UI in this PR.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

N/A — backend-only change, no visible UI.

Notes

• No new aggregation/reporting function added here — that's a natural follow-up (mirroring how Add tenant column to ai_usage_events for centralized hosted billing across ORB + AMS #7176 added the `ai_usage_events` tenant column first, and Extend usage-metric recording beyond operator-only visibility #4916/feat(api): surface per-tenant AI cost on the operator dashboard #7191 added its fleet-wide aggregate separately). This PR is scoped to the field existing and being recordable.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.77%. Comparing base (40f0eb3) to head (bb0307c).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7193   +/-   ##
=======================================
  Coverage   93.77%   93.77%           
=======================================
  Files         694      694           
  Lines       68977    68979    +2     
  Branches    18799    18801    +2     
=======================================
+ Hits        64681    64683    +2     
  Misses       3302     3302           
  Partials      994      994           

Flag	Coverage Δ
shard-1	43.88% <50.00%> (-0.01%)	⬇️
shard-2	37.14% <50.00%> (+<0.01%)	⬆️
shard-3	33.10% <100.00%> (+<0.01%)	⬆️
shard-4	34.54% <50.00%> (+<0.01%)	⬆️
shard-5	32.20% <0.00%> (-0.01%)	⬇️
shard-6	45.82% <50.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/db/repositories.ts	96.71% <100.00%> (+<0.01%)	⬆️
src/db/schema.ts	72.97% <ø> (ø)
src/types.ts	100.00% <ø> (ø)