Reduce alert noise: Security Hub HIGH/CRITICAL only (#41)

## Summary

Filter Security Hub EventBridge rule from MEDIUM+ to HIGH/CRITICAL only.

A single S3 bucket create/delete was generating 6 Slack alerts:
1. Resource Created (useful)
2. Untagged Resource — Config rule (useful)
3. Resource Deleted (useful)
4. Security Hub: required-tags MEDIUM (duplicate of #2)
5. Security Hub: SSL not required MEDIUM (noise)
6. Security Hub: access logging not enabled MEDIUM (noise)

After this change: alerts 4-6 are suppressed. Config + compliance
reporter already cover tagging.

## Future work
- Batch alerts into 5-minute windows
- Deduplicate Config vs Security Hub findings
- S3 account-wide defaults for access logging

Author: Alexanderamiri

terraform/platform/monitoring/main.tf

@@ -440,18 +440,20 @@ resource "aws_securityhub_standards_subscription" "aws_foundational" {
   depends_on    = [aws_securityhub_account.main]
 }
 
-# Route Security Hub findings with severity >= MEDIUM to security SNS
+# Route Security Hub findings with severity >= HIGH to security SNS.
+# MEDIUM findings are too noisy (SSL, logging, tags) — these are covered
+# by Config rules and compliance reporter already.
 resource "aws_cloudwatch_event_rule" "securityhub_findings" {
   name        = "${var.project}-securityhub-findings"
-  description = "Route Security Hub findings (MEDIUM and above) to SNS"
+  description = "Route Security Hub findings (HIGH and above) to SNS"
 
   event_pattern = jsonencode({
     source      = ["aws.securityhub"]
     detail-type = ["Security Hub Findings - Imported"]
     detail = {
       findings = {
         Severity = {
-          Label = ["MEDIUM", "HIGH", "CRITICAL"]
+          Label = ["HIGH", "CRITICAL"]
         }
       }
     }