Interval-resolution anomaly detection (hourly spikes, baseload creep, away verification)

[delabrcd]

Sub-issue of #76 (depends on interval ingest). Interval-resolution counterpart to #45 (monthly anomaly detection).

What

Catch unusual usage at the granularity where it's actionable — the hour, not the month.

• Spike detection — flag interval points well above the expected distribution for that hour-of-day / weekday / temperature. "Unusual 4 kWh draw at 3am last Tuesday" (oven left on, space heater, failing appliance).
• Baseload creep alert — sustained rise in the always-on floor (pairs with the baseload sub-issue).
• Vacation / away verification — confirm usage actually dropped during a window you were out; flag if it didn't.

Why interval data

Monthly data can only say "this month ran high." Interval data pinpoints which night and which hour, which is what makes it actionable.

Implementation notes

• Detection logic in app/src/lib/series.ts (or a dedicated anomaly.ts), pure + tested — expected-value model can reuse the hour-of-day profile from the load-shape sub-issue.
• Surface as a list of flagged events + markers on the interval chart; no external alerting needed for v1 (the app is LAN/SSO-gated — keep it in-app).
• Coordinate with Usage/cost anomaly detection (spike vs weather-normalized expectation) #45 so the two share an expected-value model rather than forking one.

Acceptance criteria

• Interval spike detector with a documented expected-value baseline, unit-tested.
• Flagged-events view in the UI.
• Optional baseload-creep + away-verification checks.
• Shares an anomaly model with Usage/cost anomaly detection (spike vs weather-normalized expectation) #45 rather than duplicating it.