feat: aws cloudwatch metrics source

[hoalongnatsu]

What does this PR do?

Adds an enterprise AWS CloudWatch Metrics data source for the SRE agent: the
operator supplies only a region and least-privilege read access, and the agent
auto-discovers the account's CloudWatch metrics, learns a normal baseline per
(service, signal), and flags anomalies through the same training → shadow →
detect lifecycle as the existing Prometheus metric source — zero alarms or metric
definitions authored by hand. Also threads the real metric source and unit through
to the Learned Signals view and ships several table UX improvements.

Why?

Extends the enterprise metric-intelligence capability to AWS-native teams that run
on CloudWatch instead of (or alongside) Prometheus, so they get learned baselines
and anomaly detection over their existing EC2 / RDS / ELB / ElastiCache / Lambda
metrics with no instrumentation work.

How to test

1. Provide temporary AWS credentials and a region that has metrics; configure the
   region-only cloudwatch_metrics source and run the enterprise agent in
   training mode.
2. Confirm the agent discovers metrics and learns baselines, and that the Learned
   Signals view shows the correct Source (CloudWatch), Unit, and a real
   Service entity (instance / database / target — not an AZ, AMI, or roll-up).
3. Flip to shadow, then detect, to see scoring and a real incident on a
   sustained anomaly.
4. Full step-by-step walkthrough in the CloudWatch metrics demo under the docs.

Type of change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Breaking change (config / API / default behavior)
• Documentation only
• Refactor (no functional change)
• CI / build / chore

Checklist

• go test ./... passes locally
• go vet ./... is clean
• Code is gofmt'd
• Added or updated tests for the change
• Updated user-facing docs under src/ if behavior changes
• Updated ROADMAP.md if this closes a roadmap item
• No secrets, tokens, or webhook URLs introduced in source / YAML
• No new third-party dependencies (or justified in the description) —
  adds the AWS SDK for Go v2 CloudWatch client (read-only ListMetrics +
  GetMetricData), required for the new source