Anomaly detection and storage rollups now run per-site too

Two more internals moved to the per-site fan-out pattern we shipped earlier today:

• Anomaly detection. The 5-minute scheduler used to iterate every site inline in one Lambda invocation. On busy ticks — typically when a site was under a brute-force attack and generating dozens of hacking-probe alerts at once — one site could eat the whole 300-second budget, and sites later in the iteration would silently run on a longer cadence than their plan promised. Now the scheduler only enqueues per-site jobs; each anomaly check runs in its own Lambda invocation with its own time budget.
• Storage calculator. The monthly per-site S3 storage scan (used for the admin website-costs view) was at ~53% of its 900-second Lambda budget across last month's runs, with a built-in "stop early if running low on time" guard that silently dropped later sites. Same fix: one job per site, one Lambda per job.

No change to how alerts behave for you. The reason we're shipping it now rather than waiting is that the pattern had already bitten our daily digest delivery and our weekly reports — better to move every scheduled per-site loop to the same shape while the work is fresh.