feat(routing): add cost-aware policy scoring and limits

[Wibias]

Summary

RI-08 of the Router Intelligence / Routing Control Plane programme. Adds
cost-aware policy scoring and hard cost limits, reusing the canonical
price/cost normalization (src/usage/cost.ts).

Estimated cost, price-source provenance, estimated-vs-authoritative
distinction, and cost-limit exclusions are all recorded in the route-decision
trace. Unknown prices stay unknown (never free).

Scope

• src/routing/cost.ts:
  • costEvidenceForCandidate() - estimateRequestCost-backed evidence:
    estimatedUsd, priceSource (jawcode / expected / unmatched), incomplete
    (estimated usage OR expected-price overlay), limitUsd, excludedByLimit.
  • costScore() - deterministic relative score (cheaper is better, reference
    = COST_SCORE_REFERENCE_USD 1.0 or the profile limit when set); unknown
    returns null.
• src/routing/evaluator.ts:
  • hard limit: estimatedUsd > limits.maxEstimatedCostUsd -> cost-limit
    exclusion, ineligible;
  • unknown cost policy (unknownEvidence.cost): exclude -> unknown-price
    exclusion, penalize -> deterministic 0.3 floor, allow -> priority only;
  • cost weight folds into the composite score and components.cost.
• src/router.ts - execution assembles cost evidence per candidate (usage is
  unknown pre-dispatch, so execution-time cost is honestly unknown unless
  evidence is supplied via dry-run/evaluate).
• tests/cost-scoring.test.ts - 6 tests.

Estimated vs authoritative

• incomplete is set when usage was estimated OR the price came from the
  expected-price overlay; authoritative jawcode prices with reported usage are
  complete.
• No monthly billing, invoicing, or hidden automatic budgets.

Privacy / security

• Cost evidence is a derived number (USD) + source code; no prices leak into
  per-request payloads beyond the bounded trace field.
• bun run privacy:scan passes.

Compatibility

• Additive; existing configs load unchanged (limits already validated in
  RI-04). RI-05..07 behavior preserved when optimize.cost: 0 and
  unknownEvidence.cost: allow.

Dependency

• Stacked on RI-01..RI-07 (feat(routing): record durable route decision traces #1003, feat(control-plane): add indexed cursor-paginated request history #1004, feat(analytics): add route reliability and latency analytics #1005, feat(routing): add validated routing policy profiles #1011, feat(routing): execute capability-aware policy profiles #1012, feat(routing): add evidence-based route health scoring #1013, feat(routing): add quota-aware policy scoring #1014).
  Branch base: feat/ri-07-quota-aware-routing head 9dbdce2ab.

Non-goals

• No billing/invoicing/budget automation.
• No request-side token estimation at execution time (documented: cost limits
  are enforced on evidence supplied via dry-run/evaluate; execution-time cost
  stays unknown-until-proven).

Local verification (exact)

• bun x tsc --noEmit -> PASSED (0 errors)
• bun run test tests/cost-scoring.test.ts -> 6/6 pass
• Focused regression suites -> 113/113 pass across 9 files
• bun run privacy:scan -> passed

Summary by CodeRabbit

• New Features

  • Added cost-aware routing that compares estimated costs, applies configured spending limits, and supports unknown pricing policies.
  • Cost now contributes to routing scores alongside health and quota, with scores adjusted when cost data is unavailable.
  • Route decision traces now capture bounded cost evidence and scoring details.

• Documentation

  • Updated routing policy guidance to explain cost scoring, limits, and latency weighting.

• Tests

  • Added coverage for pricing sources, unknown costs, limits, cost-based selection, and trace reporting.