feat: per-client tag focus filter across service views

[Bccorb]

Summary

Add an app-level focus filter that narrows resource lists to a selected client, keyed off a resource tag (default tag key Client, configurable in ~/.seamless-glance/config.json).

This is Phase 2 of the profile/multi-tenant work. Phase 1 (in-app AWS profile switching) is delivered separately.

Important framing

This is a view/focus filter, not a security boundary. In a shared AWS account, IAM cannot scope List/Describe results by tag, so isolation is not enforceable at the API layer. The UI must label the filter honestly (e.g. Focus: Client=Acme (view filter, not an access boundary)) and never imply it restricts access.

Scope

1. Data layer: add a tags field to model structs in src/models/ and read .tags() in the corresponding src/aws/ fetchers, service by service. EC2 already reads a subset of tags (src/aws/ec2.rs), so it is the natural first vertical slice; the remaining ~12 services each need model + fetcher changes.
2. Config: configurable tag key (default Client) in ~/.seamless-glance/config.json.
3. State + command: client_filter: Option<String> plus a /client <value> command, with a picker of distinct values for the configured tag key.
4. Render: filter rows by tag[key] == value before enumerate in each view, and recompute scroll/selection math against the filtered length.
5. Honest labeling in the header/footer as described above.
6. Docs: README, docs/architecture.md, and a changeset.

Suggested sequencing

Deliver as a vertical slice starting with EC2 so the filter can be validated end-to-end before rolling across all services.

[Bccorb]

Re-checked against current main. Scope item 1 is complete; the rest is unchanged.

Done (via #35): every one of the 12 resource models now carries a tags: Tags field and the matching fetchers read them, through a shared src/aws/tags.rs. The issue's framing that "EC2 already reads a subset, the remaining ~12 services each need model + fetcher changes" no longer applies. Tags also distinguishes "no tags" from "tags could not be read", which matters here: a throttled tag lookup must not drop a resource out of a Client=Acme focus silently, as if it were untagged.

Still open: items 2 through 6, unchanged. No configurable tag key in GlanceConfig, no client_filter state, no /client command or value picker, no tag-based row filtering, no honest "view filter, not an access boundary" labeling, no docs.

Does the generic row filter added in #39 cover this? No, and it is worth being explicit about why, since the two look similar:

• It matches rendered row text, not tag values. Tags are not displayed in most views, so a Client tag is invisible to it.
• It is per-view and cleared on every view switch, deliberately, so a query typed on EC2 does not silently hide Lambda rows. feat: per-client tag focus filter across service views #8 wants the opposite: an app-level focus that persists across service views.
• It has no picker of distinct tag values, and none of the honest labeling this issue makes central.

What it does provide is precedent: App::visible_indices already routes both rendering and selection through one filtered projection, so a tag-based focus can reuse that plumbing rather than inventing its own. The remaining work here is meaningfully smaller than when this was filed.