Update OpenAI pricing, Ultrafast and quota accounting (v1.6.0)

[capisoft-lib]

Ultrafast calls were excluded from priced totals and could be shown as Standard. Add independent, dated service-tier resolution across API costs, purchased Codex credits, subscription quota calibration, profiles and exports. Preserve the original model IDs/timestamps/counters already carried through the collector and Mesh.

• Astra API Ultrafast starts September 29; its credit coverage starts conservatively at the September 30 observation. Sol 6.1 Ultrafast starts October 8. API/credits use 6x Standard; included-subscription weighting uses 8x. API context and cache-write factors stack independently.
• Correct the older Fast conflation: purchased credits use 2x, subscription weighting 2.5x. Pre-September 30 speed factors are reconstructed and marked estimated, rather than presented as exact historical invoices. This corrects an estimate, not a price cut; exported reports retain their original embedded rates.
• Support the proportional GPT-6/GPT-5.6 Batch/Flex API cards observed October 9 without inventing prior availability or Codex discounts. Add Rosalind's explicit October 5 API billing boundary and observed credit card, and the independent chat-latest API card without assigning its moving model identity.
• Distinguish and prioritize Ultrafast badges, search profiles, premiums and sourced history, including SQL summaries. Prepare release 1.6.0.

Validation: 339 root tests, 15 hosted tests/build, 6 Mesh tests/build, hosted lint/typecheck, Docker build and read-only persistence/replacement/local-collector smoke. Sixteen new regression tests cover accounting, date gates, mixed-tier aggregation/export/search, quota weighting and strict dependency-audit handling. Desktop/mobile UI checks used synthetic data and confirmed the history scroll and distinct badges. Fix the D1 test's calendar-dependent global rollup count by asserting the target historical session.

Release dependency checks: patch Sharp 0.35.5 and Source Map JS 1.2.2; Mesh audit reports zero vulnerabilities. Sites has one explicitly documented upstream advisory, GHSA-vfj7-8cjw-p6xm, with no patched Braces release. A temporary exception expires October 23 and applies only to exactly 3.0.3 and its development-only dependency chain. Other advisories, production dependencies, changed versions, incomplete metadata and expiry still fail CI. This is printed as an exception, never as a clean audit; see docs/dependency-exceptions.md and the regression tests.

Evidence: API changelog, API card, credit card, speed rules, October 8 Codex launch. Standard GPT-6 prices remain unchanged. Day-only boundaries remain estimated; unobserved fees and undocumented tiers stay outside calculated sums.

[capisoft-lib]

Self-review of e3ccc6e completed. No blocking functional findings.

Checked independent API/credit/subscription tier gates; strict 272K whole-request context accounting; cache writes charged once; Fast versus Ultrafast premiums; unknown tiers and preview models remaining unrated; conservative observed Batch/Flex coverage; mixed-tier SQL groups, search and quota calibration; and reproducible export buckets. Reviewed the historical Fast correction as a reconstructed assumption rather than an invented price-change date. Base GPT-6 token rates and saved custom prices are preserved.

Validated 339 root, 15 hosted and 6 Mesh tests, Docker build/persistence/local collector, hosted lint/typecheck and real desktop/mobile UI with synthetic data. The calendar-sensitive D1 assertion now targets the specific historical session while retaining the event-count and dirty-cache checks.

Reviewed the explicit development-only Braces advisory exception: exact package version and advisory, lockfile dev-only chain, automatic October 23 expiry, printed exception, and negative tests for production/new advisories/metadata/version/cycles. This is not zero-vulnerability Sites audit; the known upstream risk and repository-controlled glob inputs are documented. Available Sharp and Source Map JS fixes are included; Mesh audit is clean. The dependency-free Docker runtime and application request handlers do not use the affected glob parser.

Merge only after both required CI jobs pass on this exact head and the branch is current with main. Publish Docker and the private Site from merged source; preserve Site audience, settings and stored data.