[TomSoulage]

• One SQS dead-letter queue for every asynchronous step: what planner, fetch-results and notify still fail after Lambda's retries (on-failure destination, which keeps the event and the error), and what the morning schedule, the match check schedules and the MatchFinished rule cannot deliver to their Lambda (D37).
• Three CloudWatch alarms on failures of the system, not on missing scores: a message sent to the queue, a match given up while still not found on the page, and no planner run for 26 hours (D39).
• Alerts go by email through the final-whistle-alerts SNS topic, a channel that keeps working when Telegram does not (D38).
• D37–D39, the README and the architecture diagram, which now also catches up with earlier decisions and marks what is not built yet.

Notes for review:

• The email subscription is not in the stack: it is added by hand once the topic is deployed, so the address never appears in the repository or in a cdk diff. Until it is confirmed, the alarms notify nobody.
• The on-failure destinations are set on $LATEST, the version invoked today; they move to the prod alias with D15.
• Two points are verified only after deployment: that the failure queue alarm counts the messages sent by Lambda, EventBridge and Scheduler (a real failed async invocation), and that the alarms can publish on the topic.
• D39 assumes a postponed match stays on the Treize Mondial page without a score; no saved page shows one yet.

Closes #7