Authed welcome strip data — watchlist + resume + credits

AI credit snapshot for the welcome pill. Same shape consumed by the topbar credit-meter (#248) — reuses get_usage_summary.

Last-active learning path + module — the "pick up where you left off" tile. pathId + moduleId together resolve to a deep-link URL /?view=learn&path={pathId}&module={moduleId}.

The "AI clients" stat on the authed /welcome strip.

SF-MCP-USAGE-ROLLUP section 4 (docs/plans/SF-MCP-USAGE-ROLLUP.md) under CISO welcome controls 3 and 6 as amended 2026-09-23 (docs/board/audit/2026-09-23_CISO_your_ledger_mcp_usage_stat.md): the payload is exactly {state, days_7d}. It never carries a count of calls, a tool name, a key id/prefix/name, a timestamp or the caller kind -- the field set is pinned by tests/test_welcome_mcp_usage_contract.py, and extra="forbid" makes a stray key a serialization error, not a leak.

state -> days_7d, enforced below so no route branch can emit a contradiction: pointer -> null (not credentialed, OR any read failed, OR the fleet has written no row in 7 days; the client paints the D-5 "Connect Claude or Codex" pointer) off -> null (credentialed, analytics opted out) none -> 0 (credentialed, read ok, no day with a lookup) used -> 1..7 (credentialed, read ok) 0 means only "read ok, zero days"; a failure is never 0.