Fix SSH billing count read for values beginning with '4'

[danilobuerger]

The monthly SSH duration-adjusted certificate count and SSH OTP count were written to storage as plain JSON (jsonutil.EncodeJSON) but read back via the canary-aware jsonutil.DecodeJSON. These are not inverses: DecodeJSON treats the first stored byte as a compression canary, and the LZ4 canary is the ASCII digit '4' (0x34). Any count whose decimal representation began with '4' (e.g. 4, 4.1096, 42) was misread as LZ4 data, failing with "lz4: bad magic number" and returning a 500 from sys/billing/overview.

Align the SSH counters with the existing PKI and OIDC counters, which store and read these scalar float64 values via strconv. Reads use strings.TrimSpace so values previously written as JSON (with a trailing newline) remain readable, including the '4'-leading values that the old reader could not decode.

Add regression tests for the new-format round-trip and for reading the legacy JSON format.

Fixes #32013

Description

What does this PR do?

TODO only if you're a HashiCorp employee

• Backport Labels: If this fix needs to be backported, use the appropriate backport/ label that matches the desired release branch.
  • LTS: If this fixes a critical security vulnerability or severity 1 bug, it will also need to be backported to the current LTS versions of Vault. To ensure this, use all available enterprise labels.
• Jira: If this change has an associated Jira, it's referenced either in the PR description, commit message, or branch name.
• RFC: If this change has an associated RFC, please link it in the description.

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.
• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
• If applicable, I've documented the impact of any changes to security controls.

Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

[vercel]

Deployment failed with the following error:

The `vercel.json` schema validation failed with the following message: should NOT have additional property `public`

Learn More: https://vercel.com/docs/concepts/projects/project-configuration

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vault-ui	Error		Jun 25, 2026 2:55pm

[heatherezell]

Hi! Thank you so much for taking the time to submit this PR.

Our internal process for incorporating Community Edition contributions has been evolving recently, and we're still ironing out some of the details. Our goal is to preserve authorship whenever we build on a community contribution, and in this case our process fell short of that.

I did want to let you know that this problem has been addressed with https://github.com/hashicorp/vault-enterprise/pull/16557 and will be included in a future release.

Thank you again for your contribution, and I apologize that we didn't better recognize it in this instance. Your investigation and proposed fix helped us get to the right solution, and we appreciate the time and effort you invested in improving Vault.