Make filtering consistent and session discovery index-backed

[alsmola]

Closes #47.

Summary

• Adds typed session filters for user, role, account, time, session type, denied activity, and tags. Combined filters use AND semantics.
• Queries the person partition, role_index, account_index, or the recency_index delivered by Session recency GSI: bound the cross-everyone sessions scan #48, then applies remaining predicates.
• Rekeys role_index with the canonical role ARN so session filtering accepts the same role ID, ARN, or exact name as role detail.
• Makes latest globally scoped and keeps --user on sessions list only.
• Adds consistent observation-time and denied-activity filters to aggregate noun lists. Filtered rows still show lifetime counts.
• Adds session context to list and detail: top client name, role-session name, tags, and session-policy presence.
• Detects both inline session policies and managed policy ARNs supplied to AssumeRole.
• Keeps list client summaries short, such as aws-cli +1; full version and platform data remain in session detail.
• Documents filtering, selectors, session context, and responsive output.

Deployment

Re-ingest existing CloudTrail data after deployment so stored sessions use canonical role_key values and populate role_session_name and has_session_policy.

Validation

• go test ./...
• go -C ingestor test ./...
• go vet ./...
• go -C ingestor vet ./...