feat(pricing): in-process refresh + report how each price resolved - #92

Independent QA pass (Codex, xhigh) on the merged preview of #91 + #92.

- Refuse absolute-form request targets. Host said loopback while the target
  carried its own authority, and routing parses the absolute URL — so the
  allowlist and the router disagreed about which site the request was for.
  Not reachable from a browser (absolute-form only goes to proxies), but a
  parser differential is not something to leave open in the one guard that
  stands between a rebound page and the whole spend history.
- Allow the fully-qualified loopback spelling. WHATWG URL canonicalises a
  trailing dot away for IPv4 literals but not for names, so `localhost.`
  got a spurious 403 while `127.0.0.1.` passed.
- Refuse userinfo in a Host header. `evil.example@127.0.0.1` was accepted;
  the origin genuinely is loopback so this was never a bypass, but Host has
  no userinfo component and anything carrying one is malformed.
- Scan _meta values, not key names, for unenforced dates. Matching only
  `*_expiry` meant `promo_cutover: "2026-08-31 — update the price"` sailed
  past and would have expired in silence — the exact failure the validator
  exists to prevent. Now any YYYY-MM-DD parked anywhere in _meta (including
  nested) must live in the expiries array.

…n Host + sync lock (#91)

* fix(pricing): apply post-promo DeepSeek rates, machine-check curated expiries

deepseek-v4-pro was still pinned to its 75%-off launch promo 55 days after
the promo ended, so every DeepSeek row billed at 25% of true cost. The file
documented the cutover date itself, in prose, and nothing read it.

A stale price is worse than a missing one: a missing price shows $0 and looks
broken, a stale price looks fine forever.

- Correct deepseek-v4-pro to the standard rates (1.74 / 3.48 / 0.0145 / 1.74)
- Replace the free-text _meta.*_expiry keys with a structured _meta.expiries
  array (id / expires_at / what / action), carrying the Sonnet 5 2026-08-31
  cutover that was about to repeat the same failure
- Add validate:curated-expiry to ci:local so a PR opened on or after an
  expiry date fails until a human applies the action and clears the entry;
  it also rejects any regression to free-text *_expiry keys
- Stop duplicating price literals in model-breakdown's coverage test — it
  asserts the lookup path (aliases, prefixes, casing) and reads expected
  rates from the curated table, so a legitimate price fix touches one file

Closes #87

* fix(serve,sync): reject rebound Host headers, heartbeat the sync lock

Two small hardening fixes for windows that are cheap to close now and
expensive to diagnose afterwards.

Host header (#88): binding to loopback does not make the Host header
trustworthy. Under DNS rebinding a browser sends Host: attacker.example to
127.0.0.1 and treats the response as same-origin, so CORS never applies.
Mutations were already gated on a loopback Origin, but every GET
/functions/* endpoint — full spend history, model mix, project names — was
readable by any page the victim had open. Requests whose Host is not
loopback now get a 403 before any routing. isLoopbackHostname is reused from
local-api so the Host allowlist and the Origin allowlist cannot drift.
The request handler moved out of cmdServe into createRequestHandler so the
test boots a real server and asserts the API handler is never reached — a
guard that exists but is never wired is exactly the failure being prevented.

Sync lock (#89): the lock had a 5-minute staleness window and never
refreshed its own mtime, while local-sync fires on an interval. Any sync
longer than one tick — full-corpus rebuilds and migration reparses are —
had its lock stolen, letting two writers interleave appends into
queue.jsonl. A torn line is silently skipped by the reader, and a skipped
retraction row is a permanent overcount.

- Heartbeat the lock mtime every 30s (unref'd, cleared on release) and raise
  the stale window to 30 minutes: "stale" now means the holder died
- Record pid/host/startedAt in the lock, and reclaim immediately when the
  recorded process is gone — faster recovery than the old window, not slower
- Gate the stale takeover behind an atomic mkdir mutex. The previous
  check-then-act let two waiters both delete and both acquire; a rename-based
  claim was tried first and still failed a 4-way race test, because rename is
  atomic but does not bind the check to the act
- Clean up a failed lock write instead of leaking the fd and an empty file

Closes #88
Closes #89

* fix(serve,pricing): close QA findings on the Host guard and expiry check

Independent QA pass (Codex, xhigh) on the merged preview of #91 + #92.

- Refuse absolute-form request targets. Host said loopback while the target
  carried its own authority, and routing parses the absolute URL — so the
  allowlist and the router disagreed about which site the request was for.
  Not reachable from a browser (absolute-form only goes to proxies), but a
  parser differential is not something to leave open in the one guard that
  stands between a rebound page and the whole spend history.
- Allow the fully-qualified loopback spelling. WHATWG URL canonicalises a
  trailing dot away for IPv4 literals but not for names, so `localhost.`
  got a spurious 403 while `127.0.0.1.` passed.
- Refuse userinfo in a Host header. `evil.example@127.0.0.1` was accepted;
  the origin genuinely is loopback so this was never a bypass, but Host has
  no userinfo component and anything carrying one is malformed.
- Scan _meta values, not key names, for unenforced dates. Matching only
  `*_expiry` meant `promo_cutover: "2026-08-31 — update the price"` sailed
  past and would have expired in silence — the exact failure the validator
  exists to prevent. Now any YYYY-MM-DD parked anywhere in _meta (including
  nested) must live in the expiries array.

* fix(serve): treat empty userinfo as userinfo, refuse network-path targets

QA re-check found two gaps in the previous round's guard.

- "@localhost" and ":@localhost" parse to a falsy url.username, so checking
  the parsed fields let exactly the malformed forms through while the
  fully-spelled "user:pass@localhost" was refused. Test the raw header for
  "@" instead.
- "//evil/x" and "/\\evil/x" start with a slash and so passed the
  origin-form check, but WHATWG URL resolves both against a foreign authority
  (new URL("/\\evil/x", "http://localhost").hostname === "evil").
  Routing only reads url.pathname today, so nothing is exploitable now — but
  handing a handler a URL that points at someone else's origin is the same
  guard-vs-parser disagreement absolute-form creates.

* fix(serve): refuse control characters in the Host header and request target

QA re-check found the last hole in the prefix checks: WHATWG URL strips tab,
LF and CR from its input BEFORE parsing, so "/<tab>//evil/x" becomes
"//evil/x" and adopts a foreign authority after passing a startsWith("//")
test. Same trick applies to the Host string.

Verified over a socket that Node's own parser returns 400 for those bytes in a
request-target before the handler ever runs, so this was not reachable through
the real server — recorded in the test so the next reader does not have to
re-derive it. Fixed anyway: a guard that holds only because a different layer
happens to be strict is exactly the guard-vs-parser disagreement this function
exists to prevent.

---------

Co-authored-by: itarun.p <itarun.p@somapait.com>

Ships the QA-gated fixes from #91 and #92: corrected DeepSeek rates with a
machine-checked expiry, Host-header and sync-lock hardening, and pricing that
refreshes in-process and reports how each price resolved.

prepublishOnly re-vendored the LiteLLM seed, which now carries claude-opus-5 —
so a cold start prices it correctly even before the first background refresh.

Closes issue 106. README:32 already made this claim and the product did not
compute it: it showed what usage WOULD cost at list price, and it showed a quota
bar, but the comparison — the actual decision — was left as mental arithmetic
against a plan price nothing ever asked for.

Every input already existed: per-source cost per window and the pricing tier
telling you how much to trust it, both already on the model-breakdown endpoint.

The arithmetic is a subtraction. THE LABELLING IS THE HARD PART, which is why
the logic lives in a pure module with its own tests rather than inside JSX.

Three rules, all from the issue, each with a test that fails if a future edit
drops it:

1. It never says "you saved". This is LIST-PRICE-EQUIVALENT, not a
   counterfactual bill — anyone actually on the API would use it differently.
   A test asserts the rendered card contains no "saved", "savings", "wasted",
   "worth it" or "bargain", and the disclaimer line always renders.
2. It inherits the pricing caveats from #92. If any model in the window is
   unpriced or fuzzy-matched, the figure is a FLOOR and says so, naming the
   models. `unattributed` from #94 counts as unpriced. One floor anywhere makes
   the whole roll-up a floor — averaging confidence would let a well-priced
   provider vouch for a badly-priced one.
3. Under-usage reads exactly like over-usage. "$3 of usage on a $20 plan" is a
   downgrade signal and is as useful as the other direction, so neither gets a
   colour or a verdict. Tested by asserting the below case renders the same
   sentence with no "over"/"under" language.

The plan price is entered by the user and stored in localStorage. Never sent
anywhere — no plan catalogue to maintain and go stale, and a plan price is
exactly the kind of thing this product promises not to transmit. A test asserts
the storage hook contains no fetch and imports no API client.

Absent is never zero, in three places: no stored price means no comparison
rather than a $0 plan (which is infinitely over by construction), clearing the
field stores nothing rather than 0, and a provider the user has not priced is
left out of the roll-up entirely rather than inflating the list-price side.

I nearly shipped this without an input. The card rendered "enter what you pay"
with nowhere to enter it, which is not a feature. The inputs render in BOTH
states because in the empty state they are the only way out of it.

README:32 rewritten to match what shipped rather than left overselling it — the
issue's own instruction if the honest framing could not be made to fit. It can,
so the claim now names the window, the list-price-equivalence, and the floor.

37 new tests: 14 on the pure comparison, 8 on storage (corrupt JSON, non-object,
non-positive values, a write that throws), 14 on the card, plus a wiring guard.
That last one is a source-fact test rather than a render test because there is
no DashboardView harness — and this session already produced the lesson twice: a
Vite build stayed green over a deleted identifier, and a notice went into a
component nothing mounts.

ci:local exit 0: 952 root tests, 302 dashboard.

Co-authored-by: itarun.p <itarun.p@somapait.com>