fix: add validation to prevent token counter corruption

- Add max 500k tokens per session limit (Claude's context is ~200k)
- Add max 100k tokens per update to prevent sudden jumps from parsing errors
- Reject "M" suffix values > 0.5M to prevent false matches in output text
- Add validation to restoreTokens() to reject corrupted values from state.json
- Add validation to addToGlobalStats() for negative and absurd values
- Fix daily sessions count: track unique session IDs instead of incrementing
  on every 5-minute recording interval
- Pass sessionId to recordDailyUsage() for accurate session counting

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/web/server.ts

@@ -2167,7 +2167,7 @@ export class WebServer extends EventEmitter {
         const deltaInput = session.inputTokens - lastRecorded.input;
         const deltaOutput = session.outputTokens - lastRecorded.output;
         if (deltaInput > 0 || deltaOutput > 0) {
-          this.store.recordDailyUsage(deltaInput, deltaOutput);
+          this.store.recordDailyUsage(deltaInput, deltaOutput, sessionId);
         }
         this.lastRecordedTokens.delete(sessionId);
         console.log(`[Server] Added to global stats: ${session.inputTokens + session.outputTokens} tokens, $${session.totalCost.toFixed(4)} from session ${sessionId}`);
@@ -3036,7 +3036,7 @@ export class WebServer extends EventEmitter {
       const deltaOutput = session.outputTokens - last.output;
 
       if (deltaInput > 0 || deltaOutput > 0) {
-        this.store.recordDailyUsage(deltaInput, deltaOutput);
+        this.store.recordDailyUsage(deltaInput, deltaOutput, sessionId);
         this.lastRecordedTokens.set(sessionId, {
           input: session.inputTokens,
           output: session.outputTokens,