feat(anomalies): a metric out of its normal is an anomaly to review (#5740)

#5740 "A metric that departs from its normal is recorded as an anomaly to
review, and is findable after it ends", milestone 513.

- Every minute each learned key's last 15 minutes is judged against its
  hour's normal: above the usual hold x1.25 and by the metric's floor opens
  an occurrence, which ends when the level comes back.
- metric_anomalies holds one row per item to review; a repeat while it
  still waits joins it as an occurrence (metric_anomaly_spans).
- An ended row nobody reviews within anomalies.review_days (14, Settings ->
  Thresholds) lapses; an ongoing one never does.
- Learning skips every hour an occurrence covers unless its anomaly was
  marked normal: no normal is learned without review.
- Alerts -> Anomalies lists those to review first, then the reviewed and
  lapsed under day dividers; marking is operator/admin and audited.
- The Overview widget and get_overview warn of open ones and count those
  to review; the host page shows its own; the weekly report lists the
  week's and the lapsed; MCP list_anomalies and review_anomaly.
- Reviewed and lapsed rows are pruned at data.retention_days, and kept
  in backups like alert history.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/app.py

@@ -449,6 +449,10 @@ def _register_core_tasks(app: Quart) -> None:
         from .core.norms import run_norms
         await run_norms(app)
 
+    async def run_metric_anomalies():
+        from .core.anomalies import run_anomalies
+        await run_anomalies(app)
+
     async def run_email_outbox():
         from .core.outbox import send_due
         await send_due(app)
@@ -520,6 +524,14 @@ def _register_core_tasks(app: Quart) -> None:
             interval_seconds=3600,
             run_on_startup=False,
         ),
+        # Each learned metric's last 15 minutes against its normal (#5740):
+        # opens, extends and ends anomalies, and lapses unreviewed ones.
+        ScheduledTask(
+            name="metric_anomalies",
+            coro_factory=run_metric_anomalies,
+            interval_seconds=60,
+            run_on_startup=False,
+        ),
     ])
 
     # Pull Ansible git sources as each falls due. One task reads the sources