feat(admin-costs): per-session cost-anatomy drill-down page

[philmerrell]

Summary

SPA follow-up #2 from backend PR #697 — the admin page consuming GET /admin/costs/sessions/{session_id}/calls. Frontend-only; the backend contract is already live.

• Models: SessionCostAnatomy, SessionCallRow, PrefixFingerprints, and the CacheStatus union in admin-cost.models.ts (exported via the existing models barrel).
• Service: AdminCostHttpService.getSessionCostAnatomy(sessionId) (URL-encodes the id).
• Route: /admin/costs/sessions/:id (lazy loadComponent, route param via component input binding). No sidebar entry — drill-down only, mirroring /admin/users/:userId.
• Entry point: session-id lookup form on the Cost Analytics dashboard that navigates to the drill-down.

The page

• Summary header: total cost, cache efficiency (— when null), avoidable-miss count (red when > 0), wasted USD, cache read/write token totals.
• Calls table (chronological): timestamp, model, in/read/write/out tokens, cost, color-coded cacheStatus badge (hit=green, first_write=blue, miss_ttl_expired=yellow, miss_avoidable=red, uncached=gray, null=—), cache gap, wasted USD.
• Fingerprint diffing: each row's prefixFingerprints are compared against the nearest previous fingerprinted call; a flipped hash (Tools / System / History) is highlighted red in the truncated 8-char chips — on a miss_avoidable row, that flipped hash names the cache-buster. Rows with null fingerprints (predating the feature) are skipped as baselines. Expandable rows show full hashes, messageCount, messageId, and the raw timestamp.
• 404 renders a distinct "no cost rows for this session" empty state; loading + generic error (with retry) handled via resource().

Follows the newer admin idiom (skills pages): resource()-backed loading, rounded-2xl containers/badges, text-sm/6 / text-xs/5, blue-600 primary actions, focus-visible outlines, dark mode.

Testing

• ng test: 41 specs pass across the costs feature, including new specs for the fingerprint-diff util (baseline skipping, partial hashes), the HTTP method (URL + encoding), and page states (load, 404 vs other errors, expansion, formatters, badge mapping).
• ng build passes (pre-existing bundle-budget warning only).

Manual test script

1. Sign in as an admin → Admin → Cost Analytics.
2. In the new "Session Cost Anatomy" card, paste a session id from a cost investigation and hit Inspect.
3. Verify the summary rollups match the API response, and that rows render chronologically with status badges.
4. On a miss_avoidable row, confirm exactly the flipped fingerprint chip is highlighted red and matches the changed hash in the expanded detail.
5. Enter a bogus session id → expect the "No cost rows for this session" empty state (not a raw error).

🤖 Generated with Claude Code