Implement `resources:unused` — find idle resources via CloudWatch metrics

Implementation issue split out from #107.

Replace the mock-data body in packages/ts-cloud/bin/commands/cost.ts (resources:unused command) with real implementation:

• For each resource type, define a heuristic for "unused" using CloudWatch metrics:
  • EC2: avg CPU < 5% over 30 days
  • RDS: zero connections + minimal IOPS over 14 days
  • EBS: detached volumes
  • EIP: not associated
  • S3: empty buckets + no requests over 90 days
  • Lambda: zero invocations over 30 days
  • ElastiCache: low cache hit rate + zero connections
• Aggregate into the same table shape the current mock returns.

Acceptance

• cloud resources:unused returns real candidates from the connected account.
• Per-resource recommendation reflects the heuristic that flagged it.
• Total monthly savings sums to a real Cost Explorer figure for those resource IDs (where CUR is configured).
• --profile honored.
• Replaces the cli.warn('not implemented') guard introduced by #107.

Related

• #107 — tactical guard
• Will benefit from resources command (#108-ish) being implemented first to share the resource-discovery layer.