fix: align insights, alerts, budgets, and incidents with API contracts

[dmitrijs-pavlovs-dev]

Summary

Several tools ignored filters or pagination, dropped useful response fields, or required unrelated fields on partial updates. This change aligns the insights, alerts, budgets, anomalies, and cloud-incident tools with their API contracts.

• Fix recommendation provider mapping, category filtering, cursor continuation, and easy-win values; add pagination to insight resource reads. Preserve legacy provider/pageSize inputs and return migration guidance for unsupported numeric pages or empty cursors.
• Preserve anomaly resource and cost fields, allow partial alert updates, reject empty patches, and align alert validation with supported API values. Direct status-only insight changes to the metadata-preserving endpoint and explain POST replacement behavior.
• Apply budget name filters before pagination, normalize empty budget lists, and send incident platform constraints through the endpoint-specific filter parser. Preserve cursors on sparse pages and honor the relevant filters in demo mode.

Validation

• After integrating the latest main, 1,219 unit tests and 284 integration tests passed locally on Node 22 with Yarn 1.
• yarn check:dev, yarn check:ci, yarn build, and git diff --check passed. All required Tests/Build and Integration CI jobs passed for both Node floor and Node next on head cf01c6c.
• Real dev API before/after validation: separately built baseline 15b6b1c and feature revisions ran actual stdio MCP tools/call requests against https://api-dev.doit.com with equivalent inputs. The live comparison reproduced recommendation page-size/provider/category/easy-win defects, resource pagination, dropped anomaly fields, budget name filtering, AWS incident filtering, and rejection of name-only alert updates.
• The live run also exposed a feature regression where an empty budget response omitted budgets; the branch now returns budgets: [], with a regression test and successful live retest.
• Failure-path checks covered invalid cursors/pages, conflicting incident platform constraints, empty alert patches, and invalid insight statuses. The reproduced defects and successful failure-path checks are distinct; unchanged baseline behavior is not counted as a reproduced defect.
• Cleanup verified: one disposable alert and three disposable insights were deleted in finally; independent GET requests returned 404 for every created resource. No resources remain.

Demo-token filtering and sparse category-page edge cases remain deterministic-test coverage. Additional live alert enum variants, budget writes, hosted OAuth, and switched-customer behavior were not exercised. Status-only updates preserved metadata in both builds; live POST omission cleared the optional description, supporting the revised tool guidance.

The dev comparison preceded the final base-branch integration; the integrated head passed the local and CI suites above. Earlier validation inputs and outcomes are retained in docs/validation/insights-alerts.json.