docs: add AUDIT.md — security & quality audit (status reflects current code)

[john988]

Summary

Adds AUDIT.md — a point-in-time security & quality audit of claude-usage. Docs-only; no code changes.

• Multi-dimension review (scanner correctness, cost accuracy, data integrity, security, cross-platform, performance, maintainability, docs) with adversarial per-finding verification: 80 raised → 73 confirmed / 7 refuted.
• It audited a local checkout that was ~2 months behind main, so the status column reflects the current code — it explicitly marks which findings v1.4.0 already resolved (pricing/XSS/threading/tests/…) and which are addressed elsewhere.
• Records the verified-safe (refuted) items too, so they don't get re-reported: e.g. the PRAGMA table_info(...) / AGENT_TYPE_EXPR f-strings are not injectable (constants only), Path.home() + dual subagents separators are cross-platform-correct, and the CLI's derived cache rates equal the dashboard's explicit ones.

Severity summary (confirmed)

0 critical · 2 high · 9 medium · 42 low · 20 info — the two "high" rows were the same claude-opus-4-8 mispricing (already fixed in v1.4.0).

Notes

• This is a community audit contributed from a fork — please adjust framing/scope as you see fit, or treat it as a checklist rather than something to merge verbatim.
• A few rows reference a separate feature branch (subagent attribution + optional ccusage integration) for where certain items are addressed; that work is in a different PR and isn't part of this docs-only change.
• The full raw per-finding output (all 73 with verification rationale) is large and lives outside the repo; AUDIT.md links to where it was produced.

[phuryn]

Thanks for putting this together, @john988 — a multi-dimension audit with per-finding verification is real work and genuinely useful.

We treated it as a checklist rather than merging verbatim (matching your own framing). The confirmed findings are addressed — pricing/XSS/threading/test items in v1.4.0, the subagent rows in v1.5.0 — and the verified-safe items (the PRAGMA table_info/AGENT_TYPE_EXPR f-strings being constants-only, Path.home() + dual subagents separators, CLI/dashboard cache-rate parity) are noted.

We're going to pass on keeping a static AUDIT.md in-tree, though — a point-in-time audit goes stale fast (this one already audited a checkout ~2 months behind), and we'd rather track issues as they arise than carry a snapshot. Closing for that reason; the audit itself shaped real fixes. Thank you! 🙏