feat(traefik): a 4xx share is worth a look only once it is a lot of 4xx (#6105)

Three 404s on a quiet router read 7.5% and were raised as an anomaly; most of
the 4xx anomalies on review stood for 3 to 7 errors in 15 minutes. A new
Settings → Thresholds minimum, traefik.threshold.min_4xx (default 20, more
than one a minute held for the window), applies to both the router's grade
on its page and to anomaly detection, as min_5xx does for 5xx.

learn_normal takes `fewest`: for a share gated on a per-second rate, the
fewest events (rate × window × share) it must stand for to be judged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/mcp/tools/anomalies.py

@@ -312,7 +312,9 @@ async def get_metric_normal(source_module: str, resource: str, metric: str) -> d
         "learned": bool(slots), "kind": kind,
         "floor": rnd(floor, 3), "floor_setting": learned.floor_name,
         "only_while": ({"metric": learned.gate[0],
-                        "at_least": rnd(learned.gate[1]() if callable(learned.gate[1]) else learned.gate[1], 3)}
+                        "at_least": rnd(learned.gate[1]() if callable(learned.gate[1]) else learned.gate[1], 3),
+                        "fewest_events": (None if learned.fewest is None else
+                                          rnd(learned.fewest() if callable(learned.fewest) else learned.fewest, 3))}
                        if learned.gate else None),
         "now": ({"slot": current.slot, "label": slot_label(current.kind, current.slot),
                  "usual_hold": rnd(current.usual_hold, 3), "usual_peak": rnd(current.usual_peak, 3),