[EL-32] Add usage, budgets, retention, exact-cache, prompt-cache, and batch-job dashboards

[sodejm]

Catalog ID: EL-32

Public issue: #127

Reviewed baseline: 71abaf4067d4118f28910a22c20524b4e0282b28

Core objective: Provide privacy-minimal operational dashboards and controls
for aggregate usage, explicit budgets, retention, caches, and batch jobs without
displaying or storing prompt or response payloads.

Priority / phase: P2 / Operational controls

Publication status: Published as #127.

Dependency mapping

• Blocks: None
• Depends On: #108, #110, Feature: add LLM usage, budget, and retention management #15, Feature: add an encrypted consent-scoped exact LLM result cache #21, Feature: use provider-native prompt caching with privacy-aware telemetry #22, Feature: add consent-aware provider batch execution for deferred research jobs #25
• Relates To: Feature: add token preflight and local genealogy context materialization #23, Research: benchmark LangChain and LiteLLM against native provider adapters #24, Bug: enforce request timeouts and safe streaming lifecycle across providers #26

UX/UI requirements

• Provide scoped date filters, provider/model breakdowns, budgets, cache
  statistics, retention controls, batch status, and accessible chart tables.
• Distinguish estimates from provider-reported values.
• Confirm cache clearing, retention reduction, and batch cancellation.
• Never display payloads, secrets, or precise sensitive filenames.

Public interfaces

• Add UsageSummary, BudgetPolicy, RetentionPolicy, CacheSummary,
  CacheClearRequest, and BatchJobSummary.
• Expose aggregate counts, durations, tokens, costs, cache metrics, status, and
  coarse timestamps only.
• Budget updates require scope, currency, threshold, and revision.

Underlying app changes

• Add aggregate endpoints over existing usage, cache, retention, and batch
  services.
• Add policy-enforced budget checks before generation.
• Add bounded atomic cache clearing, batch cancellation, and payload-free
  retention deletion.

Acceptance criteria

• Dashboards reconcile against deterministic seeded aggregate records.
• Prompt, response, secret, genealogy, and full-path content never appears
  in DTOs or charts.
• Warnings and hard stops occur at configured budget boundaries.
• Retention changes preview affected aggregate record counts.
• Cache clearing is scoped and audited without payloads.
• Batch status survives renderer reload and sidecar restart.
• Charts have keyboard-accessible table alternatives.
• Server aggregation and bounded results keep large datasets responsive.

Security mitigations and rejected anti-patterns

• Applies TM-S01, TM-L02, TM-A02, TM-C01, and TM-O01.
• Reject payload telemetry, prompt/response dashboards, secret-derived provider
  inference, client-only budgets, unbounded histories, raw cache inspection,
  and sensitive filenames.

Workspace mapping

• Exclusive owned paths: desktop/src/features/operations-dashboard/**,
  src/ancestryllm/api/routes/operations_dashboard/**,
  tests/api/operations_dashboard/**, and
  desktop/tests/operations-dashboard/**.
• Shared-file rule: Request narrowly scoped changes from existing usage,
  cache, retention, and batch owners; shared schemas/dependencies remain
  owner-managed.
• Base rule: Branch from updated main after all dependencies merge.
• Branch: feature/electron-el-32-operations-dashboard
• Worktree: /Users/justinsoderberg/Development/worktrees/ancestryllm-electron-el-32-operations-dashboard
• Validation: make test; make lint; make typecheck; make security;
  pnpm --dir desktop test; pnpm --dir desktop typecheck

[sodejm]

Recommended Codex configuration

• Planning: gpt-5.6-sol with high reasoning
• Implementation: gpt-5.6-sol with xhigh reasoning
• Rationale: This issue includes security, privacy, concurrency, provider-boundary, or genealogy data-integrity concerns that require deeper implementation reasoning and verification.
• Delivery: Use test-case-driven development: translate the acceptance criteria into failing or characterization tests first, implement incrementally, then run the applicable tests, lint, typecheck, security, integration, and hosted gates.