look at adding max token usage per scan and per month

I wonder if we should have some settings to try and limit AI token usage so cost of using the tool doesn't go crazy if not managed well

No file or test is named. Start by locating the AI request and configuration entry points, then trace where token usage can be measured for a scan and across time. Done means the project has agreed settings and enforced limits for both scopes, with tests covering usage within and beyond each limit.

Written by the indexing model from the issue text.