Add per-user daily token quota with persistent usage tracking

.env.example

@@ -8,12 +8,26 @@ MOCK_AI=false
 # Required for the AI draft button, unless MOCK_AI=true.
 ANTHROPIC_API_KEY=your-anthropic-api-key-here
 
-# Required for company deployment. Leave both blank for solo local use with
-# no login prompt. Set both to require a login for anyone reaching this tool.
+# Named users. Comma-separated user:password pairs. Each name doubles as the
+# identity used for the per-user token quota below.
+# Example: APP_USERS=alice:pass1,bob:pass2,carol:pass3
+# Leave blank for solo local use with no login prompt (usage is then tracked
+# under the identity "local").
+APP_USERS=
+
+# Legacy single shared login. Only used if APP_USERS is blank. Everyone who
+# logs in with this pair shares one identity and one token quota.
 APP_USERNAME=
 APP_PASSWORD=
 
-# Optional. Caps AI draft calls per source IP, to limit cost from the shared
-# ANTHROPIC_API_KEY. Defaults: 20 requests per 5 minutes.
+# Optional. Caps AI draft calls per source IP, to catch a runaway script
+# fast. Defaults: 20 requests per 5 minutes.
 RATE_LIMIT_MAX=20
 RATE_LIMIT_WINDOW_MS=300000
+
+# Caps combined input+output tokens per named user, per UTC calendar day.
+# Default: 50000 tokens/day (roughly 100-200 AI drafts with this tool's
+# prompt size). Usage is written to TOKEN_USAGE_FILE and persists across
+# restarts if that file's folder is a mounted volume.
+TOKEN_LIMIT_PER_USER=50000
+TOKEN_USAGE_FILE=./data/token-usage.json