Add bot-author filter with per-metric defaults

[snopoke]

Summary

• New --exclude-bots / --include-bots mutually-exclusive CLI flags. Default mode applies per-metric bot policies locked in DEFAULT_EXCLUDE_BOTS:
  • Bots counted: deploy-freq-prs, change-failure-rate, change-failure-prs, hotfixes, hotfix-count. Bot PRs ship real changes / real defects.
  • Bots excluded: lead-time, review-latency, large-prs, weekend-merges. Bot velocity / scheduling distorts the human signal.
  • Mixed (composite): summary resolves each component using its own default.
  • N/A: deploy-freq reads the deployments table — no author column.
• JSON envelope grows top-level bot_policy ("default" | "all-excluded" | "all-included") and per-metric exclude_bots (bool | null) so the dashboard can render policy-aware UI.
• Dashboard shows a humans only chip on each KPI tile / panel whose data excludes bots, plus a top banner when a global override is active.
• Detection uses the existing author column (GitHub bot logins are suffix-tagged *[bot]). No schema migration; no dora pull re-run required.

Backwards-compatible: reports without the new envelope fields render fine — the dashboard treats missing flags as null (no chip, no banner).

Test plan

• `uv run pytest --ignore=tests/test_upload.py` passes (97/97). The two pre-existing `test_upload.py` failures are due to the optional `s3` extra not being installed in the dev sync.
• End-to-end JSON sanity: `run_report` against the seeded fixture emits the expected `bot_policy` and per-metric `exclude_bots` shape across all three policy modes (default, force-exclude, force-include).
• Sample dashboard renders the chip on the four expected tiles/panels (lead-time, review-latency, large-prs, weekend-merges) with no banner; flipping `bot_policy` to `all-excluded` in `sample.json` shows the banner.
• Reviewer runs `dora report --exclude-bots` against their DB and confirms dependabot disappears from review-latency / large-prs / weekend-merges but stays in deploy-freq-prs.

🤖 Generated with Claude Code