feat(traefik): a 4xx share is worth a look only once it is a lot of 4xx (#6105)

Three 404s on a quiet router read 7.5% and were raised as an anomaly; most of
the 4xx anomalies on review stood for 3 to 7 errors in 15 minutes. A new
Settings → Thresholds minimum, traefik.threshold.min_4xx (default 20, more
than one a minute held for the window), applies to both the router's grade
on its page and to anomaly detection, as min_5xx does for 5xx.

learn_normal takes `fewest`: for a share gated on a per-second rate, the
fewest events (rate × window × share) it must stand for to be judged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/settings/routes.py

@@ -147,6 +147,7 @@ _THRESHOLD_FIELDS = [
     ("error_4xx_pct", "traefik.threshold.error_4xx_pct", True),
     ("min_requests", "traefik.threshold.min_requests", False),
     ("min_5xx", "traefik.threshold.min_5xx", False),
+    ("min_4xx", "traefik.threshold.min_4xx", False),
     # Each normal's floor (#5742), named by its own setting key.
     *[(f"norms.floor.{name}", f"norms.floor.{name}", True) for name in NORM_FLOORS],
 ]