Usage read path and smoke (slice B of #66): GET /usage/data behind Access #69

Why

Part of setkernel-live#66 (the per-seat daily token table) and the v1 tracker setkernel/hq#721. PR #67 did all of #66 in 401 changed lines, one over the 400-line review limit, so it is split in two. Take the code from #67's branch agent/66-setkernel-live-usage-durable-object-with (head 642f2efb) onto current main, keeping only this slice's parts. Each slice leaves main deployable: this site deploys on every merge.

Slice B of 2: the private read route. Starts after slice A merges.

Acceptance criteria

• Usage.month() and GET /usage/data?month=YYYY-MM checked against USAGE_AUD; USAGE_AUD: "" in wrangler.jsonc answers 503, so merging before the Access app exists is safe; Cache-Control: no-store
• Per Halifax day per seat sums plus month totals; a bucket at 03:00Z on a DST day lands on the previous Halifax day (test)
• Worker tests for 403 per token mix, 503 when USAGE_AUD is empty, and a bad month
• scripts/smoke.mjs checks GET /usage/data is refused (401/403/503, never 200), with its test/smoke.test.mjs cases; README documents the route and how to read a failed smoke
• npm run validate passes; under 400 changed lines; the PR says Closes setkernel/setkernel-live#66
• The PR body says Closes setkernel/setkernel-live#<this issue> and Refs setkernel/hq#721

Files likely touched

• src/usage.js
• src/worker.js
• wrangler.jsonc
• scripts/smoke.mjs
• test/smoke.test.mjs
• test/worker/usage.test.js
• README.md

Risk class

R3: a private read route; it must fail closed

— Claude Lead