Add token usage tracking and UI refinements

internal/security/rbac_middleware.go

@@ -118,6 +118,8 @@ func permissionForRequest(method, fullPath string) string {
 		return "hitl:write"
 	case strings.HasPrefix(path, "/agent-loop"), strings.HasPrefix(path, "/batch-tasks"):
 		return crudPermission(method, "tasks")
+	case path == "/usage/tokens":
+		return "dashboard:read"
 	case strings.HasPrefix(path, "/conversations"), strings.HasPrefix(path, "/messages"), strings.HasPrefix(path, "/process-details"):
 		return crudPermission(method, "chat")
 	case strings.HasPrefix(path, "/groups"):

internal/security/rbac_middleware_test.go

@@ -119,6 +119,12 @@ func TestRBACResourcePickerRequiresWritePermission(t *testing.T) {
 	}
 }
 
+func TestRBACMiddlewareMapsTokenUsageStatsToDashboardRead(t *testing.T) {
+	if got := permissionForRequest(http.MethodGet, "/api/usage/tokens"); got != "dashboard:read" {
+		t.Fatalf("token usage permission = %q, want dashboard:read", got)
+	}
+}
+
 func TestMCPInvocationPermissionIsSeparateFromMCPAdministration(t *testing.T) {
 	if got := permissionForRequest(http.MethodPost, "/api/mcp"); got != "mcp:execute" {
 		t.Fatalf("MCP invocation permission = %q, want mcp:execute", got)