docs: document usage and billing data privacy

[Ramino2406]

Summary

Document the privacy properties of usage data that the application actually stores today. The existing observability guide describes a proposed ledger, so explicitly label that design and distinguish its content-free requirement from current conversation storage.

Linked issue

Closes #488

Changes

• Add a usage and billing privacy guide covering stored counters, user/workspace scoping, sharing, retention, exports, deletion, and operational logs/cache/backups.
• State that prompts and completions must never enter the planned usage ledger, while accurately documenting that current Message records store conversation content alongside counters.
• Mark unimplemented observability endpoints and LEDGER settings as proposals and link the guide from the README.

Validation

• pytest fully green: 2,246 passed, 2 failed across all 123 test files (Python 3.12.15; four normal pytest batches).
• ruff check . passes.
• black --check . passes (263 files unchanged).
• Docs updated; no runtime behavior changed, so no new tests added.
• python scripts/check_assets.py passes.
• git diff --check and relative source-link checks pass.

Acceptance criterion	Evidence
Stored data, access and retention documented	Guide links actual models, routes and helpers; distinguishes a query window from retention.
Export and deletion covered	Documents owner-only exports, message cascade deletion and retained copies/logs/cache limitations.
No prompts/completions in ledger	Explicit requirement for planned ledger; avoids incorrectly claiming current message storage excludes content.
Documentation matches implementation	Audited against upstream revision 0e37c6d; missing ledger APIs/configuration explicitly identified.

Notes for reviewers

There is no implemented standalone usage/billing ledger in this revision. This documentation does not introduce one or promise an unenforced retention policy. When the Phase 10 ledger lands, the guide should be updated against its actual schema and cleanup/access controls. No dependencies or application code changed.

Existing test failures and CI

Both failures are in tests/test_notifications.py::TestBudgetAlertDeduplication:

• test_repeated_crossings_alert_once_per_period
• test_new_period_resets_deduplication

Both raise ModuleNotFoundError: No module named 'app.services.budget_alerts'. The imported module is absent from upstream main at 0e37c6d, and this branch changes neither app/ nor tests/. These are baseline failures, not introduced by this documentation change.

The full sequential run was slow on Windows, and pytest-xdist hit a Windows WMI startup exception before executing tests. Verification therefore used four independent normal pytest processes, assigning every tests/test_*.py file once in sorted round-robin order: python -m pytest -p no:xdist --durations=5 <batch files>. Batch results: 509 passed; 629 passed; 559 passed; 549 passed / 2 failed. The temporary parallel-runner tooling is outside the repository; no dependencies changed.

Upstream CI run reports action_required and awaits maintainer approval; no CI pass is claimed.

[drips-wave]

@Ramino2406 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits