feat(forensics): forensic read-only resource

Adds a Forensics resource exposing the detection engine's audit trail:

- client.forensics.incident_timeline(id) → IncidentTimelineDto
- client.forensics.check_trace(check_id) → CheckTraceDto
- client.forensics.policy_snapshot(hash_hex) → PolicySnapshotDto
- client.forensics.monitor_rule_evaluations(monitor_id, rule_type=, region=,
  only_matched=, from_=, to=, page=, size=) → Page[RuleEvaluationDto]
- client.forensics.monitor_transitions(monitor_id, from_=, to=, page=, size=)
  → Page[IncidentStateTransitionDto]

Pydantic models for IncidentTimelineDto, CheckTraceDto, PolicySnapshotDto,
RuleEvaluationDto, IncidentStateTransitionDto regenerated from the API spec
and re-exported from devhelm.types / devhelm.__init__.

Made-with: Cursor

Author: caballeto

docs/openapi/monitoring-api.json

@@ -19,6 +19,7 @@
 from devhelm.resources.dependencies import Dependencies
 from devhelm.resources.deploy_lock import DeployLock
 from devhelm.resources.environments import Environments
+from devhelm.resources.forensics import Forensics
 from devhelm.resources.incidents import Incidents
 from devhelm.resources.monitors import Monitors
 from devhelm.resources.notification_policies import NotificationPolicies
@@ -42,6 +43,7 @@
     AssertionSeverity,
     AssertionTestResultDto,
     CheckResultDto,
+    CheckTraceDto,
     ConfirmationPolicyType,
     CreateAlertChannelRequest,
     CreateApiKeyRequest,
@@ -67,7 +69,9 @@
     IncidentNewStatus,
     IncidentOldStatus,
     IncidentSeverity,
+    IncidentStateTransitionDto,
     IncidentStatus,
+    IncidentTimelineDto,
     IncidentUpdateCreatedBy,
     LinkedIncidentStatus,
     MembershipStatus,
@@ -80,13 +84,15 @@
     MonitorVersionDto,
     NotificationDispatchStatus,
     NotificationPolicyDto,
+    PolicySnapshotDto,
     PublishIncidentStatus,
     ReorderComponentsRequest,
     ReorderPageLayoutRequest,
     ResolveIncidentRequest,
     ResourceGroupDto,
     ResourceGroupHealthStatus,
     ResourceGroupMemberDto,
+    RuleEvaluationDto,
     SecretDto,
     ServiceSubscriptionDto,
     StatusPageBranding,
@@ -148,6 +154,7 @@
     # Resource classes
     "Monitors",
     "Incidents",
+    "Forensics",
     "AlertChannels",
     "NotificationPolicies",
     "Environments",
@@ -173,6 +180,11 @@
     "MonitorDto",
     "IncidentDto",
     "IncidentDetailDto",
+    "IncidentTimelineDto",
+    "IncidentStateTransitionDto",
+    "PolicySnapshotDto",
+    "RuleEvaluationDto",
+    "CheckTraceDto",
     "AlertChannelDto",
     "NotificationPolicyDto",
     "EnvironmentDto",