[os-wanquota] Dual-WAN billing-cycle quota and consumer reporting

[etreby]

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guidelines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I have searched the existing issues, open and closed, and I am convinced that this proposal is new.
• This is a new plugin proposal; the proposed plugin name is included in the title.

Is your feature request related to a problem? Please describe.

Metered multi-WAN users need billing-cycle accounting per provider and a compact view of which LAN hosts consume the allowance. The existing vnStat, ntopng, Insight/NetFlow, and Unbound integrations expose useful source data, but do not combine provider-specific cycle days, quotas, remaining allowance, projections, host rankings, and explicitly coverage-labelled domain attribution in one OPNsense reporting view.

Describe the solution you'd like

I would like to contribute a new source-only plugin named os-wanquota:

https://github.com/etreby/opnsense-wanquota

Current reviewed community preview: https://github.com/etreby/opnsense-wanquota/releases/tag/v0.2.1

The proposed plugin provides:

• two configurable WAN providers resolved through OPNsense logical interfaces;
• decimal-GB quota, billing-cycle day, warning threshold, download/upload totals, remaining allowance, daily budget, and projected usage;
• daily and monthly vnStat history, JSON API, reporting page, and clickable dashboard widgets;
• top LAN hosts from ntopng host RRDs;
• optional domain estimates by correlating Insight egress flow bytes with recently observed Unbound A/AAAA answers;
• a mandatory attribution-coverage indicator and documentation of DoH/DoT, VPN, ECH, CDN/shared-IP, and observation-window limitations;
• standard OPNsense install, upgrade, migration, configd reload, user-cache refresh, scheduler ownership, and uninstall lifecycle handling.

The repository is BSD-2-Clause licensed and contains no precompiled binaries, production configuration, credentials, traffic databases, or device inventory. It integrates existing OPNsense facilities and packages (vnstat, ntopng, Insight/NetFlow, and optionally Unbound); no new service binary is bundled.

Before opening a pull request, I would appreciate maintainer guidance on:

1. Whether a new plugin in the net category is appropriate, or the quota-only portion should extend net/vnstat.
2. Whether read-only use of ntopng RRDs and the Insight aggregate SQLite database is acceptable, or a different stable interface is preferred.
3. Whether the first contribution should omit DNS/domain attribution and introduce it separately after quota and host reporting are reviewed.

Describe alternatives you've considered

• Using the existing vnStat interface pages alone. These provide durable interface counters but do not model different provider billing-cycle days, allowance projections, or LAN consumers.
• Using ntopng alone. It provides strong traffic exploration but does not provide provider-specific quota-cycle accounting in the OPNsense dashboard.
• Extending net/vnstat instead of creating a separate plugin. This may be preferable for quota-only reporting, but the consumer and DNS-correlation features span ntopng, Insight, and Unbound; maintainer direction is requested.
• Omitting domain attribution. Host totals and WAN quota accounting work independently, so domain estimates can be separated if their source interfaces are considered too unstable for an initial contribution.

Additional context

Sanitized screenshots using documentation-only addresses and synthetic traffic:

• Dashboard widgets: https://github.com/etreby/opnsense-wanquota/blob/main/docs/screenshots/dashboard-widgets.png
• Consumer and attributed-domain report: https://github.com/etreby/opnsense-wanquota/blob/main/docs/screenshots/consumer-report.png

The preview has been packaged using the official OPNsense plugin framework and validated on OPNsense 26.7. Existing configuration survived upgrade; menu/ACL cache refresh, configd actions, cron ownership, quota reports, host reports, domain reports, and dashboard links were tested. GitHub CI passes on the current release.

AI assistance disclosure required by the contribution policy: OpenAI Codex (GPT-5 family) was used during implementation and public-release hardening, with human review. An additional Claude review was performed before v0.2.1.

This replaces #5641, which was opened without the required issue template.