model-usage: the vendor-neutral usage store (ADR 0054)

The home ADR 0050 left open for a usage reading. mesh-control is a CLI and
cannot consume events, so the store that keeps the current usage picture is a
MODULE — the audit-logger's sibling: it consumes `module.*.usage.*` and upserts
each reading into its own provisioned postgres store, latest per
(licence, consumer, period, metric), in the clear. One vendor-neutral table
holds BOTH grains; they differ only in `consumer` (the holding module for the
licence grain, the session for the finer one). The consumer creates its table
on startup and, as a restart-until-ready service, self-heals rather than
gating the apply on a run-once that must reach a provider over the overlay.

The vendor->row normalisation moves into the adapter, as ADR 0054 requires:
anthropic-manager (licence grain, utilization%) and anthropic-consumer (session
grain, token/cost) now emit already-normalised { rows: UsageRow[], raw } on
their existing keys, so the store stays vendor-blind.

Proven end to end by the mesh-lab model-usage bed (green): a usage event
emitted into the mesh is upserted at both grains, latest-per-key, in the clear.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/model-usage/module.json

@@ -0,0 +1,66 @@
+{
+  "module": "model-usage",
+  "version": "1",
+  "slug": "usage",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "postgres-database"
+  ],
+  "contributes": {
+    "postgres-database": {
+      "name": "model_usage"
+    }
+  },
+  "binds": {
+    "postgres-database": "/var/lib/model-usage/database.json"
+  },
+  "secrets": {
+    "postgres-database": "/var/lib/model-usage/database.secret"
+  },
+  "consumes": [
+    "module.*.usage.*"
+  ],
+  "own-secrets": {
+    "broker": "/var/lib/mesh/model-usage/broker"
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/model-usage",
+      "mode": "0700"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "path": "/var/lib/model-usage",
+      "mode": "0700"
+    },
+    {
+      "id": "db-env",
+      "type": "file",
+      "path": "/var/lib/model-usage/db.env",
+      "mode": "0600",
+      "content": "DATABASE_URL=postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\n"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-model-usage",
+      "image": "mesh-runtime-model-usage@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/model-usage/broker:/run/secrets/broker:ro",
+        "/var/lib/model-usage:/run/state"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker"
+      },
+      "env-file": [
+        "/var/lib/model-usage/db.env"
+      ]
+    }
+  ]
+}