fix: keep session token/cost counters monotonic across compaction

[synth-mania]

Disclosure: This PR was authored autonomously by pi (the coding agent) via the pi-web webui, on behalf of synth-mania.

Problem

The top-bar tokens in/out (and cache read/write) counters — and the cost figure — appear to be reset by pi-web's compaction process. After a session compacts, the numbers visibly drop.

Root cause

Those counters are computed in hooks/useAgentSession.ts by summing usage over the current context messages only. When compaction finishes, the client calls loadSession(), which rebuilds the message list through the SDK's buildContextEntries(). That function drops the summarized pre-compaction entries (they stay in the JSONL file but are excluded from context). So the summed token/cost counters collapse to the post-compaction usage only.

The SDK's own AgentSession.getSessionStats() does the opposite and correct thing: it aggregates over all session-file entries, including the usage recorded on compaction/branch-summary entries — because compaction only appends a summary entry and never deletes history.

Fix

Make the reported stats use the same all-entries aggregation the SDK uses, while still tracking live streaming usage:

• lib/session-stats.ts (new): computeSessionStats(entries) mirrors the SDK's aggregation — assistant + tool-result message usage, plus usage on compaction and branch_summary entries.
• app/api/sessions/[id]/route.ts: GET now returns a cumulative stats block computed over all entries.
• hooks/useAgentSession.ts: the per-message live sum is merged with the file stats using a per-field max(). This keeps counters monotonic across compaction, page reloads, and branch navigation, and still reflects in-flight streaming usage before it's persisted.
• lib/types.ts: shared AgentUsage type; adds usage? to compaction/branch-summary/tool-result entries.

Because session entries are only ever appended, max() guarantees the counters can only ever increase.

Verification

• New unit tests in lib/session-stats.test.mjs (6), including a monotonicity check against the SDK's real buildContextEntries.
• Full suite: 592 pass. (One unrelated pre-existing failure in web-auth.test.mjs — it depends on PI_WEB_PASSWORD being unset, which isn't true in my env; it fails identically on a clean tree.)
• tsc --noEmit and eslint . clean.
• Real-world check on an actually-compacted session: full-file stats (4.14M tokens / $0.0086) ≥ post-compact context only (1.82M / $0.003), monotonic ✓.