Add durable Windows VM management, nightly shutdown, and 60-day costs

[AnsonShie]

Summary

• Keep GitHub Actions batch provisioning for 1–20 Windows VMs, remove Elastic IP allocation, use dynamic public IPv4 addresses, and report instance and network details.
• Persist admin-only VM assignment metadata in SQLite. Admins can manage assignments; users search by exact instance ID and receive the private IP and cost details.
• Add a scheduled Lambda workflow that stops managed Windows VMs every day at 01:00 Asia/Taipei.
• Replace the 14-day Cost Explorer and Elastic IP estimate with CUR 2.0 plus Athena, providing rolling 60-day effective VM costs and explicit availability states.

Rollout notes

• The workflow provisions the cost-reporting foundation and scheduler before deploying the Portal.
• Initial CUR delivery can take up to 24 hours. Older history may require an AWS Support backfill.
• Existing VMs are not rebuilt by this PR; recreate them through the workflow if they need the updated networking behavior.
• No live AWS deployment or production mutation was performed while implementing this PR.

Verification

• uv sync --frozen
• Portal test suite: 57 passed
• Lambda test suite: 3 passed
• Ruff check and format check passed
• cfn-lint passed for all four CloudFormation templates
• Ansible syntax check passed with local optional-collection warnings
• Docker build could not complete locally because the base-image registry timed out; the PR validation workflow now performs the Docker build

Notes

• The implementation plan and design documents remain local ignored files and are not included in this PR.