feat(anomalies): a metric out of its normal is an anomaly to review (#5740)

#5740 "A metric that departs from its normal is recorded as an anomaly to
review, and is findable after it ends", milestone 513.

- Every minute each learned key's last 15 minutes is judged against its
  hour's normal: above the usual hold x1.25 and by the metric's floor opens
  an occurrence, which ends when the level comes back.
- metric_anomalies holds one row per item to review; a repeat while it
  still waits joins it as an occurrence (metric_anomaly_spans).
- An ended row nobody reviews within anomalies.review_days (14, Settings ->
  Thresholds) lapses; an ongoing one never does.
- Learning skips every hour an occurrence covers unless its anomaly was
  marked normal: no normal is learned without review.
- Alerts -> Anomalies lists those to review first, then the reviewed and
  lapsed under day dividers; marking is operator/admin and audited.
- The Overview widget and get_overview warn of open ones and count those
  to review; the host page shows its own; the weekly report lists the
  week's and the lapsed; MCP list_anomalies and review_anomaly.
- Reviewed and lapsed rows are pruned at data.retention_days, and kept
  in backups like alert history.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/audit/service.py

@@ -265,13 +265,15 @@ def detail_facts(detail: dict, scopes: dict[str, str]) -> list[dict]:
     return facts
 
 
-def mark_day_groups(items: list[dict], tz, group: str = "", now=None) -> str:
+def mark_day_groups(items: list[dict], tz, group: str = "", now=None,
+                    at=lambda item: item["event"].timestamp) -> str:
     """Give each newest-first entry its recency group (formatting.day_group,
     in the reader's zone) and whether it opens one, so the page draws a
     divider there. `group` is the one the previous page ended in: a group
-    split across pages is opened once. Returns the group this page ends in."""
+    split across pages is opened once. `at` reads an entry's moment.
+    Returns the group this page ends in."""
     for item in items:
-        item["group"] = day_group(item["event"].timestamp, tz, now)
+        item["group"] = day_group(at(item), tz, now)
         item["opens_group"] = item["group"] != group
         group = item["group"]
     return group