Pull usage and cost data from vendor admin APIs to close the shadow-AI coverage gap — anything that doesn't flow through the proxy (claude.ai, Claude Desktop, direct API). Admin keys are encrypted at rest and used only by the sync job; the dashboard shows only the fingerprint.