feat(cli): add and document headless command mode and API key/provider management

[wauputr4]

Summary

This PR completes and documents headless operation for 9Router so it can be used as an API-only service and automation-safe CLI client without opening the web/TUI screens.

Why

• Enable API-first usage in CI, scripts, and local automation.
• Remove ambiguity between "run server" and "run command against server".
• Fix a usage-reporting issue caused by nested token fields in usage history rows.

What changed

1) Headless mode behavior

• --headless now has an explicit two-flow workflow.
• Server mode: starts the API endpoint only.
• Command mode: runs 9router <resource> <action> against a running server.
• Headless mode keeps the child server supervised, prints crash logs, and retries with bounded restarts.

2) CLI command coverage

• Added/clarified non-interactive commands for API keys, providers, and usage.
• Examples now use explicit --host/--port in command mode.

3) Usage reporting robustness

• API key usage endpoint now reads token totals from row.tokens structure.
• Prevents usage summaries from always showing zero tokens.

4) Documentation

• Updated cli/README.md and cli/CLI_HEADLESS.md.
• Added clear startup-and-command flow examples plus ECONNREFUSED troubleshooting.

Headless vs Terminal UI (what changed)

• Headless (--headless)

  • Purpose: run 9Router as an API/automation surface (no interactive terminal/dashboard UI).
  • Typical use case: CI jobs, scripts, remote servers, one-command endpoint management.
  • Entry: 9router --headless --host 127.0.0.1 --port 20128

• Terminal UI / default mode

  • Purpose: interactive operation by user with menu-driven workflow and dashboard launch/selection.
  • Typical use case: local manual setup, debugging, quick browsing through keys/providers/usage.
  • Entry: 9router (then choose interface), usually opens web/TUI path.

Functional impact

• Interactive dashboard/TUI flow remains unchanged.
• Added API-only mode is additive and non-breaking.
• No schema-breaking changes.

Acceptance criteria

• Start headless server: 9router --headless --host 127.0.0.1 --port 20128 starts successfully.
• Command mode works against running server:
  • 9router --host 127.0.0.1 --port 20128 api-keys list
  • 9router --host 127.0.0.1 --port 20128 providers list
  • 9router --host 127.0.0.1 --port 20128 usage key <key_id> --period 7d
• API key usage endpoint returns non-zero token totals when usage exists.
• Restart behavior remains intact in headless mode when child process dies (no orphaned unhandled child error state).
• Documentation includes clear two-flow explanation and troubleshooting for ECONNREFUSED.

Notes

• This PR is the upstream equivalent of fork PR wauputr4/9router#1.