Add post-aggregation filters for certified metrics

[vara-bonthu]

Problem

The semantic query API supports filters on source fields before aggregation, but it cannot filter aggregated metric results.

This prevents common analytical questions such as:

• Which accounts have ARR greater than $1 million?
• Which regions have more than 100 customers?
• Which products have an error rate above 5%?

These requests require bounded post-aggregation filtering through HAVING or a safe outer query.

Proposed solution

Add metricFilters to planner.Request.

{
  "metrics": ["current_annual_recurring_revenue"],
  "dimensions": ["account.region"],
  "metricFilters": [
    {
      "metric": "current_annual_recurring_revenue",
      "op": ">",
      "value": 1000000
    }
  ]
}

Metric filters must:

• Reference only requested certified metrics.
• Use a bounded operator list.
• Reject raw SQL expressions.
• Be authorized through the same metric governance path.
• Apply before ordering and limiting.
• Be included in request hashing and plan caching.

Implementation areas

• internal/planner/plan.go
• internal/planner/plan_sql.go
• internal/serving/limits.go
• internal/serving/mcp/mcp.go
• REST, MCP, planner, StarRocks, and Trino tests

Acceptance criteria

• Metric filters support =, !=, <, <=, >, >=, and BETWEEN.
• Only requested certified metrics may be referenced.
• Unauthorized metrics are rejected before SQL generation.
• Raw expressions cannot enter the request.
• Flat and split-ratio plans support metric filters.
• Metric filters are applied before ORDER BY and LIMIT.
• Request limits bound the number of metric filters.
• REST and MCP expose identical behavior.