OWNER plane (tasks #27/#30 — the 👥 Users panel): ANONYMOUS usage rollup.

Folds the per-request telemetry ledger (by caller) into a list of anonymous users — "user 1", "user 2", … — each with last-active, request count, and distinct-question (qhash) count. The owner sees WHO is using the system + HOW MUCH, but the wire payload NEVER carries the raw caller-key labels (Jay: "I don't need any information saved, just user one, user two"). Ordinals are stable across sessions (persisted in app/data/anon_users.json — the label is the join key and stays server-side, gitignored like the other PII stores).

The local owner plane (Jay driving his own UI) is excluded by default — include_owner=1 surfaces it for debugging. LAZY + EMPTY-SAFE: a missing or corrupt telemetry/store file returns an empty list, never a 500. Admin-gated via the /owner/ prefix in metering.AUTH_PATHS (same as /owner/telemetry).