Track grading spend per user

Attribution comes from the proxy's basic-auth username, which nginx already
forwards. Recorded as a ledger of billed calls rather than a column on the
grade: a regrade overwrites the grade row, so a per-row cost would forget
what earlier runs cost, and deleting a card would erase that it was ever
paid for. Splits server-key spend (money the host actually owes) from
own-key spend (billed to the visitor) — the two must never be summed.
Attribution only, never authorization: the app is reachable directly on the
LAN, so these headers are not trustworthy for access control.

static/index.html

@@ -112,6 +112,31 @@
       gets saved here, with the full category breakdown.</p>
   </section>
 
+  <!-- -------------------------------------------------------- spend -->
+  <section class="panel" id="usage-panel" hidden>
+    <div class="panel-head">
+      <h2>Grading spend</h2>
+      <span class="hint" id="usage-total"></span>
+    </div>
+    <div class="table-scroll">
+      <table class="grid" id="usage-table">
+        <thead>
+          <tr>
+            <th>Who</th>
+            <th class="num">Grades</th>
+            <th class="num">On the server key</th>
+            <th class="num">On their own key</th>
+            <th>Last graded</th>
+          </tr>
+        </thead>
+        <tbody id="usage-body"></tbody>
+      </table>
+    </div>
+    <div class="note">Counts every grading call, including regrades, and keeps counting
+      after a card is deleted. Only the server-key column is money the owner of this
+      instance actually pays — anything on someone's own key is billed to them.</div>
+  </section>
+
 </main>
 
 <!-- ----------------------------------------------------------- settings -->