Catching rogue AI behavior with identity-aware analytics

Introduces identity-aware AI Gateway with Cloudflare Access integration, allowing authentication via SAML providers and policy setting for access control. Adds `cf.user_id` to request metadata for per-user logging and spend tracking. Introduces User Insights tab for behavioral baselining and anomaly detection, comparing session costs against a user's p95 and an account's p99 to identify deviations. Implements a dollar floor to filter out low-cost anomalies. Outlines future work on task-based smart routing and prompt classification.