feat(anomalies): a metric out of its normal is an anomaly to review (#5740)

#5740 "A metric that departs from its normal is recorded as an anomaly to
review, and is findable after it ends", milestone 513.

- Every minute each learned key's last 15 minutes is judged against its
  hour's normal: above the usual hold x1.25 and by the metric's floor opens
  an occurrence, which ends when the level comes back.
- metric_anomalies holds one row per item to review; a repeat while it
  still waits joins it as an occurrence (metric_anomaly_spans).
- An ended row nobody reviews within anomalies.review_days (14, Settings ->
  Thresholds) lapses; an ongoing one never does.
- Learning skips every hour an occurrence covers unless its anomaly was
  marked normal: no normal is learned without review.
- Alerts -> Anomalies lists those to review first, then the reviewed and
  lapsed under day dividers; marking is operator/admin and audited.
- The Overview widget and get_overview warn of open ones and count those
  to review; the host page shows its own; the weekly report lists the
  week's and the lapsed; MCP list_anomalies and review_anomaly.
- Reviewed and lapsed rows are pruned at data.retention_days, and kept
  in backups like alert history.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/core/mail.py

@@ -258,6 +258,22 @@ def burst_email(cfg: dict, alerts: list[dict], to: Recipient) -> tuple[str, str,
     return f"[Steward] {len(facts)} alerts: {said}", text, html
 
 
+def anomaly_facts(a: dict, tz: tzinfo) -> dict:
+    """A metric anomaly in the weekly report (#5740): its review as a badge,
+    and when it happened in the reader's zone."""
+    from steward.core.formatting import status_info
+    tone, review = status_info(a["review"])
+    if a["occurrences"] > 1:
+        last = (f"since {moment(a['last_started_at'], tz)}, ongoing" if a["ended_at"] is None
+                else f"{moment(a['last_started_at'], tz)} – {moment(a['ended_at'], tz)}")
+        when = f"{a['occurrences']} times since {moment(a['started_at'], tz)}, last {last}"
+    elif a["ended_at"] is None:
+        when = f"ongoing since {moment(a['started_at'], tz)}"
+    else:
+        when = f"{moment(a['started_at'], tz)} – {moment(a['ended_at'], tz)}"
+    return {"name": a["name"], "tone": tone, "review": review, "when": when, "level": a["level"]}
+
+
 def report_email(cfg: dict, data: dict, to: Recipient) -> tuple[str, str, str]:
     """(subject, text, html) for the weekly report built by
     reports.build_report_data, its dates in the recipient's zone."""
@@ -269,8 +285,12 @@ def report_email(cfg: dict, data: dict, to: Recipient) -> tuple[str, str, str]:
               else f"{start.day} {start:%b %Y} – {end.day} {end:%b %Y}")
     alerts = [{**a, "tone": status_info(a["state"])[0], "state": status_info(a["state"])[1]}
               for a in data["active_alerts"]]
+    found = data.get("anomalies") or {}
+    anomalies = {"seen": [anomaly_facts(a, tz) for a in found.get("seen", [])],
+                 "lapsed": [anomaly_facts(a, tz) for a in found.get("lapsed", [])],
+                 "to_review": found.get("to_review", 0)}
     base = (cfg.get("base_url") or "").rstrip("/")
-    text, html = _render("report", d=data, alerts=alerts, period=period,
+    text, html = _render("report", d=data, alerts=alerts, anomalies=anomalies, period=period,
                          sent=moment(data["generated_at"], tz), base=base)
     return f"[Steward] Weekly report, {period}", text, html