Claude accounts 14: keep account identifiers out of analytics

[robinebers]

TL;DR

Prevent account-specific card identifiers from being saved or transmitted in OpenUsage analytics.

What was happening

• Multi-account card and metric identifiers include a stable account-derived suffix.
• Existing telemetry treated those identifiers as ordinary provider IDs, potentially exposing account-specific values.

What this changes

• Normalize provider IDs and metric IDs to their provider family before analytics persistence or transmission.
• Deduplicate account-derived provider and metric entries in configuration snapshots.
• Add focused regressions proving account hashes never appear in telemetry events or counters.

Tests

• Full telemetry recorder privacy regression suite.

---

Note

Medium Risk
Touches analytics persistence and event payloads (privacy-sensitive data handling). The change is a narrowing of identifiers, not new collection, but mistakes here could leak account hashes or merge counters incorrectly.

Overview
Stops multi-account card hashes from being stored or sent in OpenUsage analytics. Provider and metric IDs are now reduced to their provider family (ProviderAccountID.family) before counters persist and before app_daily_active / provider_refresh_daily events fire.

Account-specific entries in the daily config snapshot are also deduped onto family IDs, so multiple Claude/Codex cards collapse to one family. Tests cover that hashes never appear in events or persisted counter keys, and that account refreshes share a single family rollup.

^{Reviewed by Cursor Bugbot for commit 556e4c5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[robinebers]

Consolidated into #1147 so the multi-account implementation remains reviewable as four cohesive PRs.