Add network session collection

[saphid]

Summary

• Adds a portable, standard-library session collector CLI (codex-usage-collector) that scans configurable tool globs (Codex, Claude, Pi, Cursor, droid, OpenCode, and more), stages changed files with host/tool metadata sidecars and incremental state, and pushes to a local or SSH central collection directory.
• Adds JSONL/syslog event logging (syslog_util.py) plus ops packaging: systemd units/timers, a launchd plist, report-refresh script, Grafana Loki datasource, and a rootless high-port LAN proxy.
• Archives the completed add-network-session-collection OpenSpec change (spec delta merged into openspec/specs/) and fixes two test-determinism issues found while landing.

Implementation notes

• The collector is dependency-free stdlib Python so it can run on any host without a venv.
• Dashboard/analysis/attribution modules gained support for collected source_path metadata, sidecar identifiers, and topology-snapshot-based attribution.
• E2E flake fix: the dashboard re-renders the spend flow behind a 60ms resize debounce, and the test's fixed 100ms post-resize sleeps raced it under host load. The test now waits for node geometry to hold stable longer than the debounce window before asserting.
• Timezone fix: the dashboard's hour/day filters intentionally use local time, and the data-function test's expectations were authored under UTC+10, so it failed on UTC CI runners. The test now pins TZ for its Node subprocess.
• Each fix is a separate commit from the feature landing.

Verification

• PYTHONPATH=src python3 -m unittest discover -q — 21 tests OK.
• pytest -q — 21 passed under TZ=UTC, TZ=America/New_York, and local Australia/Sydney.
• npm run test:e2e — 5 consecutive passes after the settle fix (previously flaky under load).
• openspec validate --all — 3 items pass, including the new network-session-collection spec.
• Reproducibility CI gate green on bcf6b61.

Risk and rollback

• The collector and ops assets are additive; the default profiler path stays read-only and local-first.
• Revert cleanly by reverting the merge; running collector deployments keep working from installed copies but should be reinstalled from a prior tag if rolled back.

🤖 Generated with Claude Code