feat(accounts): add account control center

[ozymandiashh]

Builds on #227 / issue #208 (multiple Claude config dirs). This PR turns the multi-directory foundation into a user-facing control workflow for people running Claude work, personal, desktop, or client accounts side by side.

Summary

Adds an Account Control Center to CodeBurn: account-level spend, sessions, projects, models, budgets, subscription efficiency, and wrong-account watchlist checks.

The core question this answers is not just "how much did I spend?" but:

• which account spent it?
• which project/session/model drove it?
• did I use the wrong account for a work/client repo?
• am I paying for subscriptions that are underused?
• can I export this per account for reimbursement/client/accountability?

What changed

• New codeburn accounts command with text and JSON output.
• Shorthand filter: codeburn accounts work behaves like codeburn accounts --account work.
• Per-account config stored in ~/.config/codeburn/config.json:
  • plan
  • monthlyUsd
  • budgetUsd
  • resetDay
• Global --account filtering added to usage workflows:
  • report
  • today
  • month
  • status
  • export
  • accounts
  • optimize
  • compare
• JSON report output now includes account rollups and account risks.
• CSV/JSON exports now include accounts.csv / account rows with plan and budget metadata.
• Dashboard and compare paths respect account scoping.

Detection / accountability model

Account rollups include:

• total cost
• API calls
• sessions
• project count
• edit turns / one-shot turns
• cost per session
• cost per edit
• top models
• top projects
• subscription utilization vs configured monthly price
• budget utilization vs configured monthly budget

Watchlist risks include:

1. Duplicate project across accounts — same project path appears on more than one labelled account.
2. Wrong-account heuristic — work/client-looking paths on personal accounts, or personal-looking paths on work/client accounts.
3. Underused subscription — configured monthly subscription has low API-equivalent utilization.
4. Over-budget account — account spend exceeds the configured monthly budget.

Unlabelled provider usage is still grouped as unlabelled, but it does not create duplicate-project noise against labelled Claude accounts.

Power-user workflow

For users with multiple Claude subscriptions or client accounts:

codeburn accounts
codeburn accounts work
codeburn accounts set work --plan "Claude Max" --monthly-usd 100 --budget-usd 300
codeburn accounts set personal --plan "Claude Pro" --monthly-usd 20 --budget-usd 50
codeburn report --account work --format json
codeburn export --account client-x -f csv

This makes CodeBurn useful for attribution and reimbursement, not just aggregate cost visibility.

Review fixes before push

During pre-push review with Argus / Claude Opus 4.7 and Gemini 3.1 Pro Preview, a few concrete issues were fixed before this PR was opened:

1. Account filter false positive fixed. --account work no longer includes a personal account just because the project path contains /work/. Plain filters match account label/account path; account-prefixed project matching now requires the account:path form.
2. Case-insensitive config matching. accounts set Work stores a canonical key and rollups match config case-insensitively, avoiding duplicate Work / work rows.
3. Tiny budget display fixed. Values like --budget-usd 0.001 no longer render as USD 0.
4. Wrong-account heuristic tightened. Account labels are tokenized, so homework no longer trips the work marker.
5. Export metadata added. accounts.csv / export JSON include configured plan, monthly USD, budget USD, and utilization fields.
6. CLI integration coverage expanded. Added smoke coverage for report --account, export --account, accounts <name>, and filtered account rollups.

Tests

New and updated coverage includes:

• account aggregation by label
• configured-but-unused subscriptions
• case-insensitive config matching
• duplicate-project detection
• wrong-account detection
• no duplicate warning for labelled + unlabelled provider usage
• account label/path/account-prefixed filters
• codeburn accounts set persistence
• codeburn accounts <name> filtering
• report --account --format json
• export --account -f json
• accounts.csv account rollups and plan/budget metadata

Validation

• npm run build — pass
• npm test — 42 files, 551 tests pass
• git diff --cached --check — pass
• Argus / Claude Opus 4.7 effort max — PASS CU OBSERVATII, no blockers
• Gemini 3.1 Pro Preview — PASS CU OBSERVATII, no blockers

Security

No new attack surface. This is a local read-only aggregation and config workflow over existing parsed session telemetry. No shell execution, eval, network calls, secrets handling, or remote writes beyond normal explicit export/config file writes.

CSV export continues to use the existing cell escaping path for spreadsheet-injection prefixes.

What it does NOT touch

Pricing tables, token parsing, provider discovery outside the existing #227 Claude account labels, model classification, date-range semantics, or core cost math. This PR is scoped to account-level aggregation, filtering, configuration, export, and reporting surfaces.