feat(anomalies): a metric out of its normal is an anomaly to review (#5740)

#5740 "A metric that departs from its normal is recorded as an anomaly to
review, and is findable after it ends", milestone 513.

- Every minute each learned key's last 15 minutes is judged against its
  hour's normal: above the usual hold x1.25 and by the metric's floor opens
  an occurrence, which ends when the level comes back.
- metric_anomalies holds one row per item to review; a repeat while it
  still waits joins it as an occurrence (metric_anomaly_spans).
- An ended row nobody reviews within anomalies.review_days (14, Settings ->
  Thresholds) lapses; an ongoing one never does.
- Learning skips every hour an occurrence covers unless its anomaly was
  marked normal: no normal is learned without review.
- Alerts -> Anomalies lists those to review first, then the reviewed and
  lapsed under day dividers; marking is operator/admin and audited.
- The Overview widget and get_overview warn of open ones and count those
  to review; the host page shows its own; the weekly report lists the
  week's and the lapsed; MCP list_anomalies and review_anomaly.
- Reviewed and lapsed rows are pruned at data.retention_days, and kept
  in backups like alert history.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/status/routes.py

@@ -4,6 +4,7 @@ from sqlalchemy import func, select
 
 from steward.alerts.service import active_alerts, alert_label
 from steward.auth.middleware import require_role
+from steward.core import anomalies as anom
 from steward.core.status import collect_status
 from steward.models.hosts import Host
 from steward.models.users import UserRole
@@ -29,11 +30,16 @@ async def widget():
         total_hosts = (await db.execute(
             select(func.count()).select_from(Host))).scalar()
         alerts = await active_alerts(db)
+        # Metric anomalies going on now are warnings; the ones waiting for a
+        # review are one line linking to the list (#5740).
+        anomalies = await anom.views(db, await anom.open_anomalies(db))
+        to_review = await anom.to_review_count(db)
     up, down, pending = _summarize(entries)
     return await render_template(
         "status/widget.html",
         entries=entries, up=up, down=down, pending=pending,
         total_hosts=total_hosts, alerts=overview_alerts(alerts),
+        anomalies=anomalies, to_review=to_review,
         widget_id=request.args.get("wid", "0"),
     )