feat: add high-signal services and findings (S3, IAM, EBS/EIP/snapshots, RDS security, ECS incidents)

[Bccorb]

Problem

Several highest-signal triage/waste checks are missing entirely. (Cross-check against docs/findings-roadmap.md and docs/aws-service-roadmap.md before splitting into per-service tickets.)

Gaps

• S3: no view/model at all; public buckets, missing public-access-block, unencrypted buckets.
• IAM: no module; root MFA, stale access keys, wildcard policies.
• EC2 waste: unattached EBS volumes, unused Elastic IPs, old/orphaned snapshots (model lacks the data).
• RDS security: src/models/rds.rs lacks storage_encrypted/publicly_accessible/backup_retention, so unencrypted/public/no-backup rules can't be written.
• ECS: data is fetched but produces no incident/waste finding.
• LB waste: ALB with zero registered targets (pure waste) not caught.

Impact

The waste catalog and incident coverage are thin versus the product vision.

Proposed fix

Add the models/fetchers/findings above; tags work (#35) improves attribution across them. Likely split into per-service tickets.

Acceptance

• S3 and IAM findings exist
• EC2/RDS/ECS waste+security findings exist

[Bccorb]

Re-checked against current main. Not started, with two notes.

No module exists for any named gap: no s3.rs, iam.rs, or ebs.rs in src/aws/ or src/models/. The only incidental hits are an account-overview identity counter and a UI copy string.

Two corrections to the issue's assumptions:

1. The feat: carry resource tags/ownership on all service models #35 dependency is cleared. All 12 models carry tags and the fetchers read them, so the tag-attribution groundwork this issue waited on is in place.
2. The load-balancer waste sub-bullet is arguably already covered. load_balancers_no_active_targets and load_balancers_zero_healthy_targets both exist in FINDING_RULES, and the former now carries a list-price cost estimate. Worth trimming from scope when this is picked up.

Still intact as blockers: src/models/rds.rs has no storage_encrypted, publicly_accessible, or backup_retention, so the RDS security findings need model work first. ECS is fetched but no finding rule consumes it.

Given the size, this reads more like an epic than a single issue: S3, IAM, EBS/EIP/snapshots, RDS security, and ECS incidents are five independent verticals, each needing a model, a fetcher, a view, and rules. Splitting per service would make it actionable.