[nosam1998]

Paid model calls need durable dispatch authorization and accounting before the server can safely resume matches. Add a credential-free call journal and shared match, provider-key, and optional benchmark-run spending accounts to SQLite and PostgreSQL.

Reservations, call records, and all affected balances commit together. Existing call IDs never authorize another dispatch; uncertain calls retain their reservation across restart. Settlement charges immutable pricing exactly once, preserves the original response, and records actual usage even when the host underestimated its reservation. Seat-scoped transcript pages bound both record count and payload size.

This provides the persistence port for LLM seats; enabling server-driven model players is a separate feature. The host remains responsible for selecting a conservative reservation and authorizing transcript readers.

Validation: 11 SQLite tests and both PostgreSQL integration tests pass, including simultaneous reservations and settlements, cross-scope rollback, shared run budgets, restart recovery, overspend accounting, and large transcript pagination. SQLx metadata checks pass for both backends; Clippy, formatting, and workspace dependency checks pass. Additive feat change for SemVer.