Add 'rootstock usage push': send aggregated rollups to the dashboard

[OwenPriceSkelly]

Summary

The final hop of the usage-stats design from #47: #156 writes per-session records, #159 aggregates them (usage report/compact), and this PR pushes the aggregated monthly rollup rows to the dashboard backend. The receiving endpoint is Garden-AI/rootstock-admin#6.

• rootstock usage push [--root <path>] [--dry-run] — pushes the same aggregation report shows (rollup files plus not-yet-compacted raw records), filed under the manifest's cluster name. Requires a manifest (manifest init) and the same Modal proxy-auth credentials as manifest push. The backend stores rollups per cluster per month and replaces only the months present in a push, so running it repeatedly — e.g. from the nightly smoke-test cron alongside usage compact — is idempotent and never erases previously pushed history.
• Privacy: only derived counts leave the cluster. summarize_spool already strips the salted user hashes down to unique_users counts, and the backend drops any users field defensively on ingest.
• Endpoint URL: derived from api_url by swapping the standard rootstock-admin function name (-manifest → -usage). A new optional usage_api_url config field (ROOTSTOCK_USAGE_API_URL env var) overrides it for deployments that don't follow that naming; if neither applies, the command says exactly what to set.
• The success line names the URL it pushed to — a push to the wrong deployment (dev vs prod) previously looked identical to success, which is how the delta manifest went missing from the almanac in June. --dry-run prints the resolved URL and full payload for the same reason.

Test plan

• New tests: config derivation/round-trip of usage_api_url (4), and usage push command tests covering missing credentials, non-derivable URL, missing manifest, missing spool, empty spool, --dry-run payload (counts only, no hashes), and a mocked-urlopen POST asserting URL, auth headers, and body (7).
• Full suite: 597 passed, 2 skipped (LAMMPS not installed). ruff check clean; touched files ruff formated.
• End-to-end --dry-run against a seeded temp root resolves garden-ai-dev--rootstock-admin-usage.modal.run from the standard manifest URL and emits the expected payload.
• After rootstock-admin#6 deploys to dev: real round-trip usage push → GET /usage from a login node.

🤖 Generated with Claude Code