Closes Tracer-Cloud#885

What

Adds tests/services/test_cloudwatch_client.py with direct unit tests for all three service functions in app/services/cloudwatch_client.py:

• get_metric_statistics — 5 tests: success path, no boto3, no creds, default statistics, ClientError handling
• filter_log_events — 5 tests: success, no boto3, no creds, optional params omitted, filter pattern included
• get_log_events — 5 tests: success, no boto3, no creds, ClientError, time range passed through

15 tests total.

Approach

• Mocks make_boto3_client() and require_aws_credentials() as specified — no real AWS calls
• No tool-registration assertions (tool tests are separate)
• Follows the existing test class pattern in tests/tools/
• Each test name makes the helper contract explicit