[management] Fix agent_network_admin account read and serve own usage overview

Field testing the role surfaced two gaps. GET /api/accounts validates
Settings read (the settings manager gates account settings), so an
agent_network_admin got permission denied on the endpoint the dashboard
needs to boot; grant Settings read-only, the same as network_admin.

The me/consumption endpoint returned raw per-window counter rows, which
reads nothing like the usage overview admins see. Replace it with
GET /api/agent-network/me/usage/overview: the same filter parsing,
bounds, granularity, and bucket aggregation as the admin overview, with
the user filter forced to the caller and group filters dropped, so the
dashboard renders My Usage with the exact component of the admin view
while never exposing another user's rows.

agent-network/README.md

@@ -87,8 +87,8 @@ Two roles delegate Agent Network access without account-admin rights:
 Every authenticated user, regardless of role, can read the caller-scoped
 self-service endpoints: `GET /api/agent-network/me/setup` (the endpoint, providers,
 and models the caller's own policies allow — what a local AI tool needs and nothing
-more) and `GET /api/agent-network/me/consumption` (the caller's own token and cost
-counters). Role definitions live in
+more) and `GET /api/agent-network/me/usage/overview` (the caller's own usage,
+aggregated exactly like the admin overview). Role definitions live in
 [`management/server/permissions/roles/`](../management/server/permissions/roles).
 
 ## Documentation