fix(tools): audit failed upfront dry runs and missing-figure refusals in the RI purchase tools #129

Problem

When a partial- or all-upfront dry run cannot price the offering, the purchase tool returns the error before ExecutePurchase. Only ExecutePurchase writes the preview audit record, so the failed preview leaves no audit entry. The same early return skips the audit when a confirmed upfront purchase is refused for missing approved figures (applyApprovedFigures). The EC2 tool has had this gap since #123, and #127 extends the pattern to RDS, OpenSearch, Redshift and MemoryDB. Raised by CodeRabbit on #127 (tools/aws_rds_ri.go:121).

Fix

Record both early returns through the existing refusal/audit helpers (recordPurchaseRefusal, tools/purchase.go) in all five tools, with a test per tool asserting the audit record.

Also (non-blocking review notes on #127)

• One dry-run test name claims more than it covers (no-upfront only).

• Add partial-upfront cases to the real-client boundary tests (all-upfront only today).

• Move the service-agnostic helpers out of the EC2-named tools/aws_ec2_ri_upfront.go.

• Pin the simple tool's approved_currency USD schema enum with a test (a mutation probe dropping it survived).

• README Safety model (approved upfront bullet): the sentence already says "more than 5%", but its tail "cannot buy at the higher price" reads as if any rise is refused; reword to "a rise of more than 5% between preview and purchase is refused" (CodeRabbit on fix(tools): pass the approved upfront on RDS, OpenSearch, Redshift and MemoryDB purchases #127).