feat(filter): add branch filter foundation

[prateek]

Adds the shared branch-filter foundation for a scoped (project, branch) dimension.

This layer adds branch-token parsing, branch predicates, branch metadata listing with an encoded token clients can pass back, matching SQLite/Postgres/DuckDB behavior, and generated client support for the shared filter shape. Follow-up branches can build CLI, MCP, activity, usage, and UI affordances on one API contract.

Tracking issue: #928

Follow-ups are staged as fork-internal PRs that fan out from this branch:

• Filter surfaces: feat(filter): expose branch filters in clients prateek/agentsview#1
• Activity rollups: feat(activity): add branch rollups prateek/agentsview#2
• Usage grouping: feat(usage): group usage by branch prateek/agentsview#3

Those PRs stay in the fork until this foundation lands. After that, each one can be restacked onto main and opened upstream independently.

[roborev-ci]

roborev: Combined Review (0784876)

Branch filtering is mostly wired in, but several Medium issues remain around backend parity and the branch token API contract.

Medium

• internal/postgres/search_content.go:61, internal/duckdb/store.go:1039
ContentSearchFilter.GitBranch is accepted by the HTTP/service layer, but the PostgreSQL and DuckDB content-search session filter adapters drop it. As a result, search/content?git_branch=... can return matches from all branches on those backends.
  Fix: Pass GitBranch: f.GitBranch into both db.SessionFilter literals and add backend parity coverage for content search.

• internal/server/huma_routes_usage.go:160
  Usage comparison builds the prior-period filter without copying f.GitBranch, so branch-scoped comparisons compare the selected branch’s current cost against all branches in the prior period.
  Fix: Add GitBranch: f.GitBranch to priorFilter.

• internal/db/sessions.go:2424
  The branch metadata response exposes only project and branch, while the new git_branch query parameters expect opaque encoded tokens and document them as coming from /branches. HTTP clients cannot pass the endpoint response back verbatim without duplicating the hidden separator format.
  Fix: Include an encoded token field in the branch response, or change the filter API to accept explicit project/branch values.

---

Panel: ci_default_security | Synthesis: codex, 9s | Members: codex_default (codex/default, done, 5m25s), codex_security (codex/security, done, 41s) | Total: 6m15s

[prateek]

Addressed the roborev findings in 159bb911:

• PostgreSQL and DuckDB content search now carry GitBranch into their session filters.
• Usage comparison copies GitBranch into the prior-period filter.
• /branches now returns an encoded token alongside project and branch.

Added regression coverage for the content-search filters, prior-period comparison filtering, and the branch metadata token contract.

[roborev-ci]

roborev: Combined Review (159bb91)

No issues found.

---

Panel: ci_default_security | Synthesis: codex | Members: codex_default (codex/default, done, 8m56s), codex_security (codex/security, done, 16s) | Total: 9m12s