feat: implement Tier 3 features — lane queue, credential redaction, token dashboard, xAI, Voyage AI

- Lane Queue: per-session FIFO queue in gateway replacing reject-when-busy (9 tests)
- Credential Redaction: redactConfig() expanded to cover 18+ secret fields (16 tests)
- Web UI Token Dashboard: system.tokenUsage endpoint + Usage page with summary cards
- xAI (Grok) Provider: OpenAI-compatible client with model pricing
- Voyage AI Embeddings: new embedding provider with configurable dimensions (5 tests)
- Update gap analysis: 90→95 match (70%→74%), Tier 3 section marked DONE
- Update state.json: test count 1001→1034, add tier3_completion entry

Total: 1034 tests passing across 85 files, typecheck clean

src/gateway/handlers/system.ts

@@ -1,6 +1,14 @@
 import type { GatewayRequest, OutboundMessage } from '../protocol.js';
 import { makeResponse, makeError, ErrorCode } from '../protocol.js';
 
+/** Per-session token usage report returned by system.tokenUsage. */
+export interface TokenUsageEntry {
+  sessionId: string;
+  primary: { inputTokens: number; outputTokens: number; calls: number };
+  delegation: Record<string, { inputTokens: number; outputTokens: number; calls: number }>;
+  total: { inputTokens: number; outputTokens: number; calls: number; estimatedCost: number };
+}
+
 export interface SystemHandlerDeps {
   startTime: number;
   version: string;
@@ -11,6 +19,8 @@ export interface SystemHandlerDeps {
   restart?: () => Promise<void>;
   getChannels?: () => Array<{ name: string; status: string }>;
   getUsage?: () => { totalSessions: number; activeConnections: number };
+  /** Optional callback to retrieve per-session token usage data. */
+  getTokenUsage?: () => TokenUsageEntry[];
 }
 
 export function createSystemHandlers(deps: SystemHandlerDeps) {
@@ -60,5 +70,10 @@ export function createSystemHandlers(deps: SystemHandlerDeps) {
         tools: deps.getToolCount(),
       });
     },
+
+    'system.tokenUsage': async (request: GatewayRequest): Promise<OutboundMessage> => {
+      const sessions = deps.getTokenUsage?.() ?? [];
+      return makeResponse(request.id, { sessions });
+    },
   };
 }