feat(anomalies): a metric out of its normal is an anomaly to review (#5740)

#5740 "A metric that departs from its normal is recorded as an anomaly to
review, and is findable after it ends", milestone 513.

- Every minute each learned key's last 15 minutes is judged against its
  hour's normal: above the usual hold x1.25 and by the metric's floor opens
  an occurrence, which ends when the level comes back.
- metric_anomalies holds one row per item to review; a repeat while it
  still waits joins it as an occurrence (metric_anomaly_spans).
- An ended row nobody reviews within anomalies.review_days (14, Settings ->
  Thresholds) lapses; an ongoing one never does.
- Learning skips every hour an occurrence covers unless its anomaly was
  marked normal: no normal is learned without review.
- Alerts -> Anomalies lists those to review first, then the reviewed and
  lapsed under day dividers; marking is operator/admin and audited.
- The Overview widget and get_overview warn of open ones and count those
  to review; the host page shows its own; the weekly report lists the
  week's and the lapsed; MCP list_anomalies and review_anomaly.
- Reviewed and lapsed rows are pruned at data.retention_days, and kept
  in backups like alert history.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/core/reports.py

@@ -106,6 +106,15 @@ async def build_report_data(app) -> dict:
         hosts_down = sorted(name for mid, name in enabled
                             if latest.get(mid) and not latest[mid][-1].is_up)
 
+        # ── Metric anomalies this week, and those that lapsed (#5740) ─────────
+        from steward.core import anomalies as anom
+        week = await anom.week_summary(db, cutoff_7d)
+        anomalies = {
+            "seen": [_anomaly(a) for a in week["seen"]],
+            "lapsed": [_anomaly(a) for a in week["lapsed"]],
+            "to_review": await anom.to_review_count(db),
+        }
+
     return {
         "generated_at": now,
         "uptime_summary": uptime_summary,
@@ -113,6 +122,21 @@ async def build_report_data(app) -> dict:
         "alert_events": alert_events,
         "top_routers": top_routers,
         "hosts_down": hosts_down,
+        "anomalies": anomalies,
+    }
+
+
+def _anomaly(a) -> dict:
+    """One anomaly for the report; its times are put in each reader's zone
+    when the email is written (mail.report_email)."""
+    from steward.core.formatting import metric_label, metric_value
+    return {
+        "name": f"{a.resource_name} — {metric_label(a.metric_name)}",
+        "review": a.review,
+        "started_at": a.started_at, "last_started_at": a.last_started_at, "ended_at": a.ended_at,
+        "occurrences": a.occurrences,
+        "level": (f"held {metric_value(a.metric_name, a.peak_level)}, usual "
+                  f"{metric_value(a.metric_name, a.usual_hold)}"),
     }