CLI: AWS cost-reporting command (top services, top buckets, top egress)

Context

Direct follow-on from #103 (April 2026 bill spike investigation). Even after that one is solved, we have no shared way to answer "what's costing us money this month?" without logging into the AWS console.

Proposal

Add a CLI command to ts-cloud that pulls Cost Explorer data and surfaces expensive culprits:

ts-cloud cost report                # current month, top-level service breakdown
ts-cloud cost report --month 2026-04
ts-cloud cost report --service s3 --by bucket
ts-cloud cost report --service s3 --by usage-type
ts-cloud cost report --top 10

Output sketch

AWS cost report — 2026-04 (\$687.42 total)

By service:
  S3 ......................... \$412.18  (60.0%)
  EC2 ........................ \$143.05  (20.8%)
  CloudFront ................. \$ 78.30  (11.4%)
  Data Transfer .............. \$ 32.40  ( 4.7%)
  Other ...................... \$ 21.49  ( 3.1%)

S3 top buckets:
  registry-stacksjs-prod ..... \$298.40  (DataTransfer-Out-Bytes: 2.4 TB)
  ...

Implementation notes

• Use the AWS Cost Explorer API (ce:GetCostAndUsage)
• Group by SERVICE, then drill-down by LINKED_ACCOUNT/USAGE_TYPE/RESOURCE_ID as needed
• Cache responses locally for 1h — Cost Explorer charges $0.01/request, easy to rack up
• Respect AWS_PROFILE correctly (see #99 — known foot-gun in this repo)

Acceptance

• ts-cloud cost report works against real AWS creds
• Top services + top S3 buckets + top usage types are inspectable
• Cached so we don't burn money asking AWS what we spent money on
• Documented in README

Related

• #103 — AWS bill spike investigation (this CLI is what would have caught it earlier)
• #99 — S3Client AWS_PROFILE bug (don't repeat the mistake here)