GET /v1/stats and the simlock stats --csv ledger #348

Part of #329.

Scope

After this PR, GET /v1/stats answers the same figures as simlock stats --json for the same window, and simlock stats --csv writes one row per lease request in the window, a file a spreadsheet opens.

Technical spec

Modules touched

• src/http/app.ts — GET /v1/stats?since=<duration> or ?from=<ISO>&to=<ISO>, with &ledger=1 to include the ledger; to defaults to now; both forms together, or neither, follow the CLI's rules (neither means the last 24 hours). The handler parses the query with the shared duration parser, dispatches usage.get, and returns its output as JSON. HISTORY_NOT_KEPT takes its status from the contract's error table, as every error does; a bad window is 400.
• src/contract/operations.ts — usage.get input gains includeLedger: boolean, default false; the output carries requests[] only when it is true, so a console or a plain simlock stats call never receives the ledger.
• src/core/usage/ — computeUsage output gains requests[] when asked, the ledger: { requestId, requester, label?, platform, model, workerId?, source?, requestedAt, grantedAt?, endedAt?, waitMs?, heldMs?, turnaroundMs?, outcome: "granted" | "rejected" | "open", reason?, endReason? }, one entry per lease.requested in the window.
• src/cli/index.ts — --csv on simlock stats asks for the ledger and writes it as RFC 4180 CSV to stdout, one header row, a column per ledger field in that order, timestamps as ISO 8601, empty cell for an absent value. --csv with --json is a usage error.
• docs/HTTP-API.md (route, query, errors, gateway behaviour), docs/CLI.md (--csv), docs/CLIENT.md if the ledger shows in the client type.

Contract and event changes

• usage.get input gains includeLedger (default false); output gains requests[] when it is set. Additive.
• New route GET /v1/stats. Operator token; an agent token gets 403 as every operator route does.

Rules in play

• safety.md rule 10: since, from, to are wire input, parsed and bounded before dispatch.
• architecture.md rule 10: the window rules are the CLI's and the route's through one shared function, not two copies.

Tests

• computeUsage lists one ledger entry per request with the timestamps and durations of its grant and end, and open for a request still waiting at the window's end
• the CSV writer quotes a field containing a comma, a quote or a newline, and writes an empty cell for an absent value
• simlock stats --csv prints a header row and one row per request, and rejects --csv --json
• GET /v1/stats?since=1h returns the same body as usage.get for that window, without requests[]; &ledger=1 adds it
• GET /v1/stats?from=&to= with from later than to returns 400 naming the parameter
• GET /v1/stats with no window returns the last 24 hours
• GET /v1/stats with a window that ends before the oldest held event returns HISTORY_NOT_KEPT with the status the error table gives it
• GET /v1/stats with an agent token returns 403
• (e2e) after a scripted run, curl GET /v1/stats?since=1h and simlock stats --since 1h --json print equal figures
• (e2e) simlock stats --csv --since 1h has as many data rows as lease.requested events in the window

Done when

• After a scripted run against the fake driver, GET /v1/stats?since=1h with an operator token returns the same figures as simlock stats --since 1h --json.
• simlock stats --csv --since 1h > run.csv writes a file with one header row and one row per lease request, which a spreadsheet opens with the columns separated.
• An agent token gets 403 on the route; a window older than the kept history gets 422 with the oldest kept time in the body.
• docs/HTTP-API.md describes the route under Operator routes, and docs/CLI.md describes --csv.

Out of scope

• The console view (next task).
• A Prometheus or OpenMetrics endpoint.

Depends on

• usage.get and simlock stats: the figures from the event history, on a worker and a gateway #347
• Gateway: remote agents lease and reach physical devices on workers #442
• Heartbeats keep the simlock lease alive #473

Approval

• Approved for delivery

Written by an agent.