fix(branches): correct SUM(DISTINCT) cost aggregation bug

[hashedone]

Closes #189

Root cause: SUM(DISTINCT s.estimated_cost_usd) deduplicates by cost value, not by session identity. If multiple sessions have the same cost (especially $0.00 when pricing isn't configured), they collapse to one row and the sum is wrong — showing $0.00 even when there are many sessions.

Fix: Replace with a correlated subquery that first collects the distinct (branch, session_id) pairs, then sums their costs — each session counted exactly once.

[aikido-pr-checks]

Correlated subquery in the SELECT runs per branch and can cause N+1 DB work; pre-aggregate or rewrite as a single join/subquery outside the per-row SELECT to avoid repeated scans.

Details

✨ AI Reasoning
​The new SELECT embeds a correlated subquery that computes a SUM by scanning/joining branch_tracking, commits, commit_attributions, and sessions for each result row. This turns what was a single set-based aggregation into repeated work proportional to the number of branches returned, causing database-level N+1 behavior and increased query cost as data grows.

🔧 How do I fix it?
Move constant work outside loops. Use StringBuilder instead of string concatenation in loops. Cache compiled regex patterns. Use hash-based lookups instead of nested loops. Batch database operations instead of N+1 queries.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}