PR Vision v0.3.0: per-call cost accountability + LLM call audit trail

P0 security:
- PRV_Gateway_Client: remove response body from RuntimeException (HTTP status only)
- PRV_Capture_Writer: allowlist-only write (prompt/response text, never headers/auth)
- Mandatory capture order: can_afford → probe → persist_result → update_row_cost → write_meta → capture_io
- capture_io last and wrapped in swallowing try/catch

New tables (SCHEMA_VERSION 3):
- prv_call_meta: cost/metadata per call, kept indefinitely
- prv_call_io: rendered prompt + raw response, pruned on retention window (default 90d)

New classes:
- PRV_Call_Meta_Table, PRV_Call_Io_Table: table schema + dbDelta
- PRV_Capture_Writer: metadata + I/O write; security allowlist enforced
- PRV_Prune_Cron: daily prv_daily_prune cron deletes aged prv_call_io rows only
- PRV_Cost_Rollup_Query: MTD summary, model breakdown, drill-down, projection
- PRV_Call_Log_Query: paginated + filtered call-log query + per-call I/O fetch
- PRV_Costs_Page + PRV_Costs_Renderer: Costs admin sub-page (cap progress, bento, model table, drill-down)
- PRV_Call_Log_Page + PRV_Call_Log_Table_Renderer: Call Log admin sub-page (filter bar, paginated table, WCAG AA pagination)
- PRV_Call_Drawer_Renderer: non-modal complementary drawer (5 states: Normal/Pruned/Legacy/Failed/Loading)
- PRV_Call_Drawer_Script: inline JS for drawer (300-line split from renderer)
- PRV_Call_Detail_Ajax: wp_ajax_prv_call_detail AJAX handler
- PRV_Admin_Page_Css: CSS provider (300-line split from PRV_Admin_Page)
- PRV_Probe_Run_Executor: inner probe loop (300-line split from PRV_Probe_Runner)

Updated:
- PRV_Probe_Result: tokens_in/tokens_out params + getters
- Both providers: report tokens_in/tokens_out from usage.prompt_tokens/completion_tokens
- PRV_Probe_Runner: slimmed to lock+UUID+delegation; injects PRV_Capture_Writer
- PRV_Config: get_io_retention_days(); PRV_IO_RETENTION_DEFAULT_DAYS constant
- PRV_Upgrader/Activator/Deactivator/Plugin: register new tables, cron, pages, AJAX
- Settings: retention days field + save in controller
- uninstall.php: DROP both new tables, clear prv_daily_prune cron
- Subnav 4-tab strip (Dashboard | Costs | Call Log | Settings) on all pages
- ARCHITECTURE.md, CHANGELOG.md, CONTEXT.md, CONVENTIONS.md updated

Tests:
- test-capture-writer.php: write_meta, write_io, P0 security (401 record has no key/Bearer/sk-or-)
- test-cost-audit.php: MTD reconciliation, projection, prune, forced capture_io exception, table drops

Agent-Session: peptiderepo-geomonitor-v0.3.0-cost-audit

includes/core/class-prv-call-detail-ajax.php

@@ -0,0 +1,95 @@
+<?php
+/**
+ * AJAX handler for the call-detail drawer content (v0.3.0).
+ *
+ * @package PrVision
+ */
+
+declare(strict_types=1);
+
+/**
+ * Handles the prv_call_detail AJAX action for the drawer content.
+ *
+ * Fetches metadata + I/O for a single call ID and returns the rendered
+ * drawer HTML as JSON. Enforces nonce + capability before any DB read.
+ *
+ * Security: delegates rendering to PRV_Call_Drawer_Renderer which only
+ * outputs allowlisted fields — never headers, keys, or raw HTTP bodies.
+ *
+ * Who triggers: wp_ajax_prv_call_detail hook (logged-in users only).
+ * Dependencies: PRV_Call_Log_Query, PRV_Call_Drawer_Renderer.
+ *
+ * @see class-prv-call-drawer-renderer.php — HTML renderer for the drawer.
+ * @see class-prv-call-log-query.php       — Fetches meta + io rows.
+ * @see class-prv-plugin.php               — Registers the AJAX hook.
+ * @package PrVision
+ */
+class PRV_Call_Detail_Ajax {
+
+	/**
+	 * Nonce action for the call-detail drawer.
+	 */
+	const NONCE_ACTION = 'prv_call_drawer';
+
+	/**
+	 * Register the AJAX hook.
+	 *
+	 * Side effects: Adds wp_ajax action.
+	 *
+	 * @return void
+	 */
+	public function register_hooks(): void {
+		add_action( 'wp_ajax_prv_call_detail', array( $this, 'handle' ) );
+	}
+
+	/**
+	 * Handle the AJAX request and return drawer HTML.
+	 *
+	 * Side effects: Outputs JSON; terminates request.
+	 *
+	 * @return void
+	 */
+	public function handle(): void {
+		if ( ! current_user_can( 'manage_options' ) ) {
+			wp_send_json_error( esc_html__( 'Insufficient permissions.', 'pr-vision' ) );
+		}
+
+		$nonce = isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : '';
+		if ( ! wp_verify_nonce( $nonce, self::NONCE_ACTION ) ) {
+			wp_send_json_error( esc_html__( 'Security check failed.', 'pr-vision' ) );
+		}
+
+		$call_id = isset( $_POST['call_id'] ) ? absint( wp_unslash( $_POST['call_id'] ) ) : 0;
+		if ( $call_id < 1 ) {
+			wp_send_json_error( esc_html__( 'Invalid call ID.', 'pr-vision' ) );
+		}
+
+		$query = new PRV_Call_Log_Query();
+
+		// Fetch from prv_call_meta.
+		global $wpdb;
+		$table = PRV_Call_Meta_Table::get_table_name();
+		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
+		$meta = $wpdb->get_row(
+			$wpdb->prepare(
+				// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+				"SELECT * FROM {$table} WHERE id = %d LIMIT 1",
+				$call_id
+			),
+			ARRAY_A
+		);
+
+		if ( null === $meta || ! is_array( $meta ) ) {
+			wp_send_json_error( esc_html__( 'Call not found.', 'pr-vision' ) );
+		}
+
+		$io = $query->get_call_io( $call_id );
+
+		ob_start();
+		$renderer = new PRV_Call_Drawer_Renderer();
+		$renderer->render_content( $meta, $io );
+		$html = ob_get_clean();
+
+		wp_send_json_success( array( 'html' => $html ) );
+	}
+}