[Admin][API] Cloudflare billing-actuals for authoritative platform AI spend

[serge-ivo]

Follow-up from #32 (PR #43). Token estimates are derived; the authoritative platform Workers-AI cost is Cloudflare's. Pull real neuron spend from Cloudflare GraphQL Analytics / billing API and surface it as the headline platform-spend number, with per-figure source: "cf-actuals" | "estimate". Cache the pull (rate-limited/slow).

Infra: the API worker has NO CF creds bound today (workers/api/wrangler.toml) — add CLOUDFLARE_API_TOKEN (Analytics read scope) + CLOUDFLARE_ACCOUNT_ID as secrets/vars (Doppler pags/prd already has both).

Part of the PAGS Admin Portal epic (#27). Pairs with the ledger metering follow-up.

[serge-ivo]

Closing — measurement showed this would report $0.00.

This asks for Cloudflare billing actuals as "the headline platform-spend number". The premise was that platform-paid Workers AI is a meaningful cost. It is not, and now there is data.

Measured 2026-08-06 over 30 days via /v1/admin/usage/external:

model	cost	calls
claude-sonnet-4-6 (BYOK)	$32.41	1641
OpenAI Whisper/TTS (BYOK)	$8.51	840
@cf/* (platform-paid)	$0.00	—

So the authoritative number this issue would fetch is zero, while 100% of real spend is BYOK on the user's own Anthropic and OpenAI keys — which Cloudflare cannot see. Pulling CF GraphQL analytics would add a secret binding (the API worker has no CF creds today) and a cached slow path to make a zero more precise.

Where the actual estimation error is, for anyone who comes back to this:

• Cache tokens are already priced correctly (0.1x read / 1.25x write, migration 0074) — I filed Cache-read tokens are priced at the full input rate — overstates cost ~10x on the cached path #268 claiming otherwise and closed it as wrong.
• The real gap was the Coder Engine's own spend, invisible because it runs on the user's machine. Fixed in Coding Engine spend is invisible in the usage ledger — the largest real cost isn't recorded #267 — and its cost is reported by the CLI, not estimated, marked via cost_source (migration 0080).

Reopen when platform-paid Workers AI is actually being spent — i.e. if the free tier or a platform-funded quota ships. Until then this measures nothing.