feat(traefik): a 4xx share is worth a look only once it is a lot of 4xx (#6105)

Three 404s on a quiet router read 7.5% and were raised as an anomaly; most of
the 4xx anomalies on review stood for 3 to 7 errors in 15 minutes. A new
Settings → Thresholds minimum, traefik.threshold.min_4xx (default 20, more
than one a minute held for the window), applies to both the router's grade
on its page and to anomaly detection, as min_5xx does for 5xx.

learn_normal takes `fewest`: for a share gated on a per-second rate, the
fewest events (rate × window × share) it must stand for to be judged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/plugins/traefik/test_normals.py

@@ -91,6 +91,14 @@ def test_grade_routers_hands_each_router_its_own_normals():
 
 
 def test_the_fewest_requests_to_judge_is_the_thresholds_setting():
-    fewer = to_thresholds_cfg({"traefik.threshold.min_requests": 5})
+    fewer = to_thresholds_cfg({"traefik.threshold.min_requests": 5, "traefik.threshold.min_4xx": 1})
     assert router_state(_window(e4=33.0, requests=10.0), TH, "")[0] == "ok"        # default 30
     assert router_state(_window(e4=33.0, requests=10.0), fewer, "")[0] == "warn"
+
+
+def test_a_4xx_share_is_worth_a_look_only_once_enough_4xx_were_answered():
+    # librarian@swarm on 2026-10-19: 7.5% of about 100 requests, so 7 errors (#6105)
+    assert router_state(_window(e4=7.5, requests=100.0), TH, "") == ("ok", None)
+    assert router_state(_window(e4=7.5, requests=300.0), TH, "")[0] == "warn"     # 22 errors
+    fewer = to_thresholds_cfg({"traefik.threshold.min_4xx": 5})
+    assert router_state(_window(e4=7.5, requests=100.0), fewer, "")[0] == "warn"