Add automatic Logfire export for captured sessions

[duncankmckinnon]

Summary

• Mirrors every thirdeye session into Pydantic Logfire live, as OTel traces — no separate export step. tool_call/tool_result pairs (matched on Claude's tool_use_id / Codex's call_id) merge into one span with a real duration; everything else becomes a timeline marker, all under one trace per session.
• Export is dispatched from Store.append_event — the single call site every Claude Code / Codex hook already goes through — but the actual Logfire call (configure + a network flush) runs in a detached, unwaited-for background process (thirdeye.otel_worker), so enabling this adds no latency to tool calls.
• New thirdeye logfire enable/disable/status CLI commands and a settings page + Enable/Disable button in the web UI, both persisting the gateway key and project to ~/.thirdeye/config.yaml indefinitely.
• Homebrew formula now bundles both the ui and logfire extras' resources, so brew install gets everything without a separate pip install.

Notable implementation details

• Each session becomes one Logfire trace: the first event exported becomes the trace's root span, and its real trace_id/span_id are persisted to a small otel.json sidecar so later hook subprocesses (which can't share in-memory state) parent correctly under it.
• Hardened against two issues found by hand while testing against the real logfire SDK: Logfire's default scrubber redacts any attribute whose key matches /session/, which was blanking the session identifier (fixed by using the OTel GenAI gen_ai.conversation.id key instead); and Logfire's background token-check thread writes warnings straight to stderr on a bad/unreachable token even after the call that triggered it returns, which needed a permanent process-global suppression rather than a scoped one (this runs inside hook subprocesses whose stdout/stderr Claude Code may read as part of a hook decision, so it must stay silent).
• The Homebrew formula's new resources were validated by actually building the full 35-package dependency closure from sdist into a throwaway Python 3.12 venv and running thirdeye logfire status / thirdeye --help against it, not just transcribed from a lockfile.

Test plan

• pytest — 1668 passed
• ruff check / ruff format --check clean
• Manual smoke test of real thirdeye-claude-* hook binaries with Logfire enabled (bad token): stdout/stderr silent, hook returns in ~100ms, otel.json and job-file cleanup both confirmed async
• Web settings page exercised end-to-end via Starlette TestClient and a live app instance (enable persists + masks token, disable keeps token, badge updates)
• Homebrew formula's new dependency closure built from sdist and imported successfully in a fresh venv
• Real brew install --build-from-source pass (not runnable in this environment) — worth doing before merge, along with the still-placeholder url/sha256 on the top-level thrdi source tarball pending an actual PyPI release

🤖 Generated with Claude Code