feat(token-meter): token usage & cache-hit-rate tracking with live dashboard (v1.1.0)

[HaneWari]

What changes

Adds the hosted Plugin plugins/HaneWari/token-meter (v1.1.0) plus fixture-driven smoke tests at tests/plugins/token-meter/smoke.test.mjs.

User value

Track per-model token usage and prompt-cache hit rate in MiniMax Code — including custom BYOK providers (Kimi, StepFun, …).

Example prompt: Summarize today's token usage by model with cache hit rates.
Expected result: a per-provider/model table (custom providers first) with calls, input/output/cache-read tokens, cache hit rate, and a total row, e.g. K3 — 68 calls, 97.8% cache hit, 4.0M tokens.

More copyable prompts:

• Show me the live token usage dashboard. → the agent starts the loopback live board via token_meter_live_board and returns (or, on hosts with an in-app browser tool, directly opens) http://127.0.0.1:<port>/ — an interactive dashboard with minute-precision window selection, 30 s auto-refresh, and light/dark themes.
• Draw the token usage trend from 14:00 to 16:30 today. → a widget dashboard (on hosts with mavis.widget.v1) with per-model stacked bars and a cache-hit-rate line.
• Which recent sessions consumed the most tokens? → per-session totals with titles and model mix.

Data comes only from the local MiniMax Code runtime state (read-only sqlite queries + observability-log enrichment + config display names). A SessionEnd hook (where supported) archives per-session snapshots so history survives runtime database cleanup.

Plugin submission checklist

• Plugin lives at plugins/<github-owner>/<plugin-name>.
• plugin.json name matches the Plugin directory.
• README.md includes a real example prompt and expected result.
• LICENSE and plugin.json declare an open-source license (Apache-2.0).
• Required executables, accounts, paid services, and supported platforms are disclosed (Node.js 23.4+ / 24 LTS recommended; no accounts; no paid services; Windows/macOS/Linux).
• Network destinations and data handled by the plugin are disclosed (no remote requests; optional loopback-only live board; read-only local runtime data; snapshots under the per-plugin data dir; dashboard Chart.js vendored, MIT).
• No credentials, private endpoints, hidden telemetry, installers, symlinks, or native binaries are included.
• Every scaffold TODO has been replaced.
• npm run check passes.

Evidence

• node scripts/validate.mjs → OK plugin HaneWari/token-meter ("Validated 29 hosted Plugins and all examples.")
• node --test tests/plugins/token-meter/smoke.test.mjs → 6/6 pass: tools/list, custom-first grouping with exact cache-hit-rate math, fillEmpty bucket filling, SessionEnd hook snapshot archival, live board start/fetch/stop against the fixture data dir, snapshots empty state.
• Full npm run check on Windows 11: 350 tests, 340 pass; the 7 failures reproduce identically on a pristine upstream/main worktree (pre-existing environment issues: Windows symlink privileges, python3 not on PATH, octopus-meme-maker smoke tests) and are unrelated to this PR; Ubuntu CI should be green.
• Manual end-to-end on a real MiniMax Code Desktop data directory: per-model groups with log-enriched provider/model, minute-precision trend windows with zero-filled buckets, live board serving the dashboard with every asset from 127.0.0.1 (zero external requests, verified via browser network log), SessionEnd hook writing snapshot lines.
• Package layout: root plugin.json + mcp.json (Agent Plugins 1.0), .claude-plugin/plugin.json (mcode 0.4.0+, inline SessionEnd hook), .minimax-plugin/plugin.json (Desktop), io.minimax.mcode/hooks/hooks.json (portable hook document). Skills: token-meter (text reports) and token-meter-visualizer (mavis.widget.v1 dashboard with self-contained GenUI foundation).

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}