feat(cli): add session replay

[ozymandiashh]

Summary

This adds codeburn replay <session-id>, a local session timeline for reviewing one recorded AI coding session turn by turn.

The existing dashboard and reports are good at aggregate cost visibility, but they do not make it easy to answer what happened inside a specific expensive or interesting session. replay fills that gap with a focused CLI view: prompt, cost, model, tools, shell commands, retries, edit flag, and token counts per turn.

What changed

• add a new codeburn replay <session-id> command
• search sessions by exact session id or session id prefix
• support the same practical filters users expect elsewhere:
  • --period
  • --from / --to
  • --provider
  • --project
  • --exclude
• add --json for scripts and downstream analysis
• add --no-prompts for metadata-only replay output when users do not want prompt text in stdout
• render ambiguous prefix matches as a candidate list instead of picking one silently
• document the workflow and add an Unreleased changelog entry

Output behavior

The text view prints a compact timeline with:

• project name and path
• session id and time window
• total spend, turn count, call count, and token totals
• per-turn category and cost
• user prompt, unless --no-prompts is set
• models used in the turn
• core tools, MCP tools, skills, and shell commands
• retry and edit flags

The JSON view returns the same structured replay data, with userMessage: null when --no-prompts is used.

Privacy model

replay is local-only and does not upload data. By default it shows prompt text because the command is meant to help users understand a specific session.

--no-prompts hides user prompts in both text and JSON output, but it is not a full redaction mode. Shell commands and tool names remain visible because they are part of the execution timeline. The README calls this out explicitly so users do not mistake it for a share-safe export.

Edge cases

• exact session id matches are preferred over prefix matches
• ambiguous prefixes fail with a visible candidate list and exit code 1
• empty queries return no matches in the library helper
• session id matching is case-insensitive
• candidate overflow pluralization is covered for more than 10 matches

Validation

• npx vitest run tests/replay.test.ts
• npm run build
• node dist/cli.js replay --help
• node dist/cli.js replay does-not-exist-hopefully --from 2999-01-01 --to 2999-01-02 --json exits with code 1 and the expected not-found message
• npx vitest run
• git diff --cached --check

npx tsc --noEmit is still blocked by existing src/providers/copilot.ts type errors on main; this branch does not touch that provider path.