S1 #11: bytes read and written, counted per network service

A Counted<> wrapper around the network clients adds what goes through
their buffer read and write to a per-service counter (IRC, Gemini, Debug
Console, Updates); the single-byte calls and print() end up there, so
each byte counts once. `net` prints the totals. For TLS it's the plain
text the service sees.

Checked on the device: a Gemini fetch counts 164,986 in (a 164,970-byte
page and its 16-byte header) and 42 out (the URL and CRLF).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

src/services/debug_console.cpp

@@ -17,6 +17,7 @@
 #include "file_receiver.h"
 #include "sha256.h"
 #include "platform/console.h"
+#include "platform/counted_client.h"
 #include "sd_fault.h"
 #include "version.h"
 
@@ -110,7 +111,7 @@ void DebugConsole::listen() {
             listening = false;
         }
         if (listening) {
-            NetworkClient client = server.accept();
+            Counted<NetworkClient> client(server.accept(), net::User::DebugConsole);
             if (client) {
                 client.setNoDelay(true);
                 if (authenticate(client)) serve(client);

src/services/gemini_service.cpp

@@ -12,6 +12,7 @@
 #include "gemtext.h"
 #include "platform/console.h"
 #include "sha256.h"
+#include "platform/counted_client.h"
 #include "storage_paths.h"
 
 namespace roro {
@@ -544,7 +545,7 @@ void GeminiService::fetchOne(const std::string& url, GeminiPage& page, bool load
     auto track = [this]() { lowest_ = std::min<size_t>(lowest_, esp_get_free_heap_size()); };
 
     size_t freeBefore = esp_get_free_heap_size();  // what's left once the connection closes again
-    NetworkClientSecure tls;
+    Counted<NetworkClientSecure> tls(net::User::Gemini);
     tls.setInsecure();  // trust on first use: the pinned fingerprint is what counts (Q71)
     tls.setTimeout(15);
     if (!tls.connect(u.host.c_str(), u.portOrDefault())) {

src/services/irc_service.h

@@ -1,6 +1,7 @@
 #pragma once
 
 #include <NetworkClientSecure.h>
+#include "platform/counted_client.h"
 #include <freertos/FreeRTOS.h>
 #include <freertos/semphr.h>
 
@@ -75,8 +76,8 @@ class IrcService : public Service {
     std::unique_ptr<IrcSession> session_;
     SemaphoreHandle_t lock_ = nullptr;
     TaskHandle_t task_ = nullptr;
-    NetworkClientSecure tlsClient_;
-    NetworkClient plainClient_;
+    Counted<NetworkClientSecure> tlsClient_{net::User::Irc};  // counted for the System App (S1, Q121)
+    Counted<NetworkClient> plainClient_{net::User::Irc};
     NetworkClient* conn_ = &tlsClient_;  // whichever the config asks for
     ReconnectPolicy backoff_;
     std::string partial_;

src/services/update_service.cpp

@@ -1,4 +1,5 @@
 #include "update_service.h"
+#include "platform/counted_client.h"
 
 #include <SD.h>
 #include <WiFi.h>
@@ -208,7 +209,7 @@ void UpdateService::listen() {
             }
         }
         if (listening && phase_ == Phase::Idle) {
-            NetworkClient client = server.accept();
+            Counted<NetworkClient> client(server.accept(), net::User::Updates);
             if (client) {
                 client.setNoDelay(true);
                 NetSource src(client);