fix(server): wire real total_tool_calls in process_end

[randomparity]

emit_process_end hardcoded total_tool_calls: 0 behind a "future PR can add an AtomicU64" comment, so the documented n field on every process_end audit record ("number of tool calls dispatched in this process") was always 0 — a phantom metric.

This adds a process-lifetime tool_calls: Arc<AtomicU64> to AuditWriter (mirroring the existing suppressed_failures counter), increments it once on each successful log_tool_start — the single per-dispatch chokepoint, shared across all writer clones — and exposes total_tool_calls(). emit_process_end now reads the real count.

Placing the counter on the writer (which emit_process_end already holds, and which is Arc-shared across clones) rather than on ImapMcpServer means no constructor signatures change.

Count semantics: one increment per successfully-started tool call, including the infrastructure path (use_account, list_accounts). A call counts when its tool_start is accepted (including a write suppressed under fail_open = true); a fail_open = false write failure aborts the call and is not counted.

Verification:

• new unit test total_tool_calls_counts_each_tool_start (starts at 0, increments per log_tool_start, non-tool records don't bump it, clones share the counter)
• all 155 rimap-audit lib tests pass
• cargo clippy -p rimap-audit -p rimap-server --all-targets --all-features clean

Closes #341

🤖 Generated with Claude Code