Dollar budgets ignore unpriced calls and sub-agents' spend #222

Found in the security review of the 1.5.0 changes (see #221). It isn't an attack path, since only admins pick models, but it is a configuration trap: a dollar budget can quietly never trigger.

What happens

• Unpriced calls don't count. A scope's spend is the sum of token_usage_logs.cost_usd (token_usage_service.get_cost_since, used by rate_limit_service), and calls on a model with no price have cost_usd = NULL. Affected:

  • openrouter/ models while OpenRouter's price list can't be fetched. On a server without outbound access, that's permanent: the fetch is retried hourly and there is no other source;
  • models in no price list (local models, new releases) without a manual price.

  A dollar budget over such traffic never blocks or warns. The Rate Limits usage panel shows the spend, and the Usage page shows the unpriced share, but nothing ties the two together.

• Errors fail open. A database error while summing returns 0.0, so the request is allowed.

• An agent budget covers only the agent itself. It sums rows whose agent_name is that agent. Sub-agents log under their own names, so a root agent's budget leaves out what its sub-agents spend. Token budgets behave the same way.

Options

• When a scope with a dollar budget has unpriced calls in the period, warn on the Rate Limits page next to the budget, and optionally block: a "treat unpriced calls as over budget" switch per budget.
• On the alert side, a budget alert could also fire on "unpriced calls in a dollar-budget scope".
• An agent budget could include its sub-agents, on by default for root agents, or as an option.
• Decide whether summing errors should fail closed for block budgets.

Not a release blocker for 1.5.0. The behaviour is documented: calls without a price don't count toward a dollar budget.