[Task]: Day facts query endpoint

Parent: #586 (Per-grain query APIs)

### Summary

Build the day facts query endpoint: request types, query builder, handler, and route.

### What to build

1. **`DayFactQueryRequest`** — scope: User/All, start_time, end_time, bucket, filters, group_by, limit
2. **`DayFactQueryFilters`** — source, subject_kind, is_aggregate_only, language, editor, model
3. **`DayFactGroupBy`** enum — Source, SubjectKind, SubjectId
4. **`DayFactSeriesPoint`** — bucket_start, source, subject_kind, subject_id, is_aggregate_only, total_suggestions, total_acceptances, total_lines_suggested, total_lines_accepted, total_active_users, cost_micro_usd
5. **`build_day_fact_query()`** — single-table aggregation over `usage_day_facts`
6. **Handler + route:** `POST /usage/v1/usage/facts/query`

### SQL shape

Single-table aggregation over `usage_day_facts`. Bucket-scoped truncation via `dense_rank()`. No latency percentiles (the table has no latency column).

### Scope filter

- `scope=user`: `provider_user_id = $scope_id` — only returns per-user facts (org/repo-level facts have NULL `provider_user_id` and are excluded)
- `scope=all`: no entity filter, requires `usage:read-all`
- `scope=account` / `scope=project`: return `400` (not applicable)

### Files to modify

- `crates/lightbridge-authz-usage/src/models/day_fact.rs` — NEW: request, filters, group_by, point structs
- `crates/lightbridge-authz-usage/src/repo/day_fact_query.rs` — NEW: query builder
- `crates/lightbridge-authz-usage/src/handlers/day_fact.rs` — NEW: handler
- `crates/lightbridge-authz-usage/src/routers/mod.rs` — add route

### Tests

- Seed day facts for multiple subjects → query with scope=user → assert only matching subject's rows returned
- Seed org-level facts (provider_user_id NULL) → scope=user → assert they are excluded
- scope=account → 400
- NULL cost round-trip (cost_micro_usd BIGINT, NULL = unknown)
- Bucket truncation
- Filter by subject_kind, source

### Source of truth

- Design Decision 1: `docs/plans/0586-per-grain-query-apis-analysis.md`
- Day facts DDL: `migrations-usage/20260908000001_usage_day_facts.sql`
- SubjectKind vocabulary: `crates/lightbridge-authz-usage/src/models/day_seat.rs`

### Verification evidence

To be attached on the implementing PR.