[management] Self-scope usage and log reads; give usage_viewer the filter resources

The usage overview and access-log listings no longer deny callers without
the account-wide grant: the filter is pinned to the caller (their own
user id, group filters dropped), so every authenticated user reads their
own usage and requests through the same endpoints the admin dashboard
uses. The dedicated /agent-network/me/usage/overview endpoint is removed
in favor of that fallback.

usage_viewer gains read-only access to the resources the usage view's
filters and columns resolve against: users, groups, peers, and the
provider list (provider and model filter options).

shared/management/http/api/openapi.yml

@@ -13444,7 +13444,7 @@ paths:
   /api/agent-network/access-logs:
     get:
       summary: List Agent Network access logs
-      description: Returns a paginated, server-side-filtered list of agent-network (LLM) access log entries. Available only when the account has log collection enabled; otherwise entries are not retained.
+      description: Returns a paginated, server-side-filtered list of agent-network (LLM) access log entries. Available only when the account has log collection enabled; otherwise entries are not retained. Callers without the account-wide grant are not denied - the response is scoped to their own requests (any user_id or group_id filter is overridden).
       tags: [ Agent Network ]
       security:
         - BearerAuth: [ ]
@@ -13559,7 +13559,7 @@ paths:
   /api/agent-network/access-log-sessions:
     get:
       summary: List Agent Network access logs grouped by session
-      description: Returns a paginated, server-side-filtered list of agent-network (LLM) access logs grouped by session. The page unit is a session (total_records counts sessions); each session carries an aggregate summary and its ordered entries. Requests the client sent no session id for each form their own singleton group. Accepts the same filters as the flat access-logs endpoint. Available only when the account has log collection enabled.
+      description: Returns a paginated, server-side-filtered list of agent-network (LLM) access logs grouped by session. The page unit is a session (total_records counts sessions); each session carries an aggregate summary and its ordered entries. Requests the client sent no session id for each form their own singleton group. Accepts the same filters as the flat access-logs endpoint. Available only when the account has log collection enabled. Callers without the account-wide grant are not denied - the response is scoped to their own requests (any user_id or group_id filter is overridden).
       tags: [ Agent Network ]
       security:
         - BearerAuth: [ ]
@@ -13674,7 +13674,7 @@ paths:
   /api/agent-network/usage/overview:
     get:
       summary: Agent Network usage overview
-      description: Returns agent-network token and cost usage aggregated into time buckets, server-side filtered. Usage is always collected (independent of log collection).
+      description: Returns agent-network token and cost usage aggregated into time buckets, server-side filtered. Usage is always collected (independent of log collection). Callers without the account-wide grant are not denied - the response is scoped to their own usage (any user_id or group_id filter is overridden).
       tags: [ Agent Network ]
       security:
         - BearerAuth: [ ]
@@ -13793,47 +13793,6 @@ paths:
           "$ref": "#/components/responses/requires_authentication"
         '500':
           "$ref": "#/components/responses/internal_error"
-  /api/agent-network/me/usage/overview:
-    get:
-      summary: The caller's own Agent Network usage overview
-      description: Returns the same aggregated time-bucket usage as /api/agent-network/usage/overview, pinned server-side to the calling user's own rows (any user_id or group_id filter is overridden). Available to every authenticated user regardless of role. Empty list when the caller has not consumed anything yet.
-      tags: [ Agent Network ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      parameters:
-        - in: query
-          name: granularity
-          schema:
-            type: string
-            enum: [day, week, month]
-            default: day
-          description: Time bucket width. Defaults to day.
-        - in: query
-          name: start_date
-          schema:
-            type: string
-            format: date-time
-          description: Filter by timestamp >= start_date (RFC3339 format).
-        - in: query
-          name: end_date
-          schema:
-            type: string
-            format: date-time
-          description: Filter by timestamp <= end_date (RFC3339 format).
-      responses:
-        '200':
-          description: A JSON Array of usage buckets for the calling user
-          content:
-            application/json:
-              schema:
-                type: array
-                items:
-                  $ref: '#/components/schemas/AgentNetworkUsageBucket'
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '500':
-          "$ref": "#/components/responses/internal_error"
   /api/agent-network/settings:
     get:
       summary: Retrieve Agent Network settings

shared/management/http/api/types.gen.go

@@ -1316,27 +1316,6 @@ func (e GetApiAgentNetworkAccessLogsParamsSortOrder) Valid() bool {
 	}
 }
 
-// Defines values for GetApiAgentNetworkMeUsageOverviewParamsGranularity.
-const (
-	GetApiAgentNetworkMeUsageOverviewParamsGranularityDay   GetApiAgentNetworkMeUsageOverviewParamsGranularity = "day"
-	GetApiAgentNetworkMeUsageOverviewParamsGranularityMonth GetApiAgentNetworkMeUsageOverviewParamsGranularity = "month"
-	GetApiAgentNetworkMeUsageOverviewParamsGranularityWeek  GetApiAgentNetworkMeUsageOverviewParamsGranularity = "week"
-)
-
-// Valid indicates whether the value is a known member of the GetApiAgentNetworkMeUsageOverviewParamsGranularity enum.
-func (e GetApiAgentNetworkMeUsageOverviewParamsGranularity) Valid() bool {
-	switch e {
-	case GetApiAgentNetworkMeUsageOverviewParamsGranularityDay:
-		return true
-	case GetApiAgentNetworkMeUsageOverviewParamsGranularityMonth:
-		return true
-	case GetApiAgentNetworkMeUsageOverviewParamsGranularityWeek:
-		return true
-	default:
-		return false
-	}
-}
-
 // Defines values for GetApiAgentNetworkUsageOverviewParamsGranularity.
 const (
 	GetApiAgentNetworkUsageOverviewParamsGranularityDay   GetApiAgentNetworkUsageOverviewParamsGranularity = "day"
@@ -5990,21 +5969,6 @@ type GetApiAgentNetworkAccessLogsParamsSortBy string
 // GetApiAgentNetworkAccessLogsParamsSortOrder defines parameters for GetApiAgentNetworkAccessLogs.
 type GetApiAgentNetworkAccessLogsParamsSortOrder string
 
-// GetApiAgentNetworkMeUsageOverviewParams defines parameters for GetApiAgentNetworkMeUsageOverview.
-type GetApiAgentNetworkMeUsageOverviewParams struct {
-	// Granularity Time bucket width. Defaults to day.
-	Granularity *GetApiAgentNetworkMeUsageOverviewParamsGranularity `form:"granularity,omitempty" json:"granularity,omitempty"`
-
-	// StartDate Filter by timestamp >= start_date (RFC3339 format).
-	StartDate *time.Time `form:"start_date,omitempty" json:"start_date,omitempty"`
-
-	// EndDate Filter by timestamp <= end_date (RFC3339 format).
-	EndDate *time.Time `form:"end_date,omitempty" json:"end_date,omitempty"`
-}
-
-// GetApiAgentNetworkMeUsageOverviewParamsGranularity defines parameters for GetApiAgentNetworkMeUsageOverview.
-type GetApiAgentNetworkMeUsageOverviewParamsGranularity string
-
 // GetApiAgentNetworkUsageOverviewParams defines parameters for GetApiAgentNetworkUsageOverview.
 type GetApiAgentNetworkUsageOverviewParams struct {
 	// Granularity Time bucket width. Defaults to day.