feat(observability): security operations metrics (dwell time and coverage)

**Context:** ROADMAP.md → Security operations metrics (dwell time and coverage)

---

## Component

CDK / infrastructure

## Describe the feature

CloudWatch **metrics and dashboard panels**: time from anomaly (circuit breaker trip, guardrail spike, policy deny burst) to **operator awareness**; fraction of security/ops alarms **investigated**. Targets shortened exploit windows.

## Use case

Security teams measure detection-to-response, not just alert firing. Uninvestigated alarms indicate process gaps.

## Proposed solution

1. Metric: `security_anomaly_to_ack_seconds` (anomaly event → first operator action or ticket).
2. Metric: `security_alarms_investigated_ratio` (manual tag or integration hook).
3. Dashboard row on operator dashboard.
4. Optional integration with PagerDuty/Opsgenie ack timestamps.

## Other information

- Pairs with behavioral circuit breaker and automated alert triage drafts.
- Design context: `docs/design/OBSERVABILITY.md`, `docs/design/SECURITY.md`.

- [ ] This might be a breaking change

Beginne mit dem Lesen von docs/design/OBSERVABILITY.md und docs/design/SECURITY.md und verfolge anschließend die CDK-/Infrastruktur-Einstiegspunkte für das Operator-Dashboard und die vorhandenen Alarmmetriken. Lege fest, wie Daten zu anomaly-to-ack und investigated-ratio erfasst werden, füge die benannten Metriken und die Dashboard-Zeile hinzu und überprüfe das optionale PagerDuty/Opsgenie-Verhalten, sofern es unterstützt wird.

Vom Indexierungsmodell aus dem Issue-Text verfasst.