Add spot instance recommendations

[maksimov]

Summary

• Adds a new "spot_eligible" waste signal that flags long-running on-demand GPU instances which could save money by switching to Spot pricing
• Fetches live spot prices via DescribeSpotPriceHistory API (not static lookup) to account for spot price volatility
• Adds ruleSpotEligible analysis rule: triggers for on-demand instances running 24+ hours with available spot pricing data
• Uses Info severity (softer than the existing RI Warning recommendation, since spot has interruption risk)
• Spot and RI recommendations coexist on the same instance — they represent different trade-offs
• Adds ec2:DescribeSpotPriceHistory to the minimal IAM policy output

Design decisions

• Live API over static prices: Spot GPU prices fluctuate; hardcoded discounts would produce stale recommendations
• Info severity + High risk: Spot instances carry interruption risk — recommendations are informational, not urgent alerts
• Confidence scales with savings: 0.35 + (savingsPercent / 120), capped at 0.95 — bigger discounts = higher confidence the recommendation is worthwhile
• Coexists with RI rule: An instance can get both spot and RI recommendations simultaneously since they represent different cost/reliability trade-offs

New files

• internal/providers/aws/spot.go — SpotPriceClient interface + EnrichSpotPrices function
• internal/providers/aws/spot_test.go — 5 tests for spot enrichment

Test plan

• go test ./internal/providers/aws/... — spot enrichment tests (5 tests)
• go test ./internal/analysis/... — rule tests including 5 new spot rule tests (7 sub-tests)
• go build ./... — clean build
• Manual: run gpuaudit scan against an AWS account with GPU instances to verify spot recommendations appear

🤖 Generated with Claude Code