Scope log retention deletion and floors to (host, service), not host alone

logs rows carry a real per-record `service` (nginx, smtp, ufw, ...) --
already true of the schema (storage/migrations/0001) and wire protocol,
not something this feature invents. Both the deletion picker and the
retention floor now operate on (host, service) pairs instead of whole
hosts, so an operator can delete just one noisy log type from an agent
without touching everything else it ships, and can protect one service
(e.g. keep smtp a year) longer than the rest of that host's default.

api/agents.ConfigOverride gains ServiceLogRetentionDays (map[string]int),
owner-only to change like LogRetentionDays -- a service listed there
overrides the host's LogRetentionDays default for that service only.
Agent config page gets a matching "Per-service log retention overrides"
add/remove list next to the existing host-level field.

api/logretention: Store's count/delete now take []HostService and build
a ClickHouse tuple IN ((?,?),...) over (host, service); AgentRetentionStore.
FloorsByHost returns each host's default plus its per-service map, with
HostFloor.Effective(service) resolving which one applies. preview/delete
moved from GET/DELETE-with-query-params to POST-with-JSON-body (a list of
targets needs a real body, not a repeated compound query param), and
partitionTargets checks the floor per target so one protected service
never blocks deleting a different, unprotected one in the same request.

Settings' Log retention section is a two-level picker now: each host
row (with a "select all services" checkbox and its default floor badge)
expands to its services, each with its own count and effective
protected-days badge.

Verified live against real ClickHouse/Postgres and in-browser: a host
with a 7-day default plus a 365-day smtp override -- deleting nginx+
smtp+ufw together correctly removed nginx and ufw, left smtp's 10
records untouched, and confirmed via a follow-up owner delete that
bypassing the floor works. Also verified the full click-through (add a
service override on the agent page, see it reflected in Settings'
picker, select/preview/cancel) and confirmed no regression from the
prior host-only version's tests.

api/agents/handler.go

@@ -169,6 +169,17 @@ func (h *Handler) handleSetConfig(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
+	// service_log_retention_days requires RoleOwner too, for exactly the
+	// same reason log_retention_days does -- it's the same override-floor
+	// mechanism, just keyed per service instead of once for the whole
+	// host, so it needs the same "any change, not just raising" gate.
+	if identity, ok := authz.IdentityFromContext(r.Context()); ok && !identity.Role.Satisfies(authz.RoleOwner) {
+		if changesServiceLogRetentionDays(h.currentServiceLogRetentionDays(r.Context(), h.tenantID(r), r.PathValue("host")), override.ServiceLogRetentionDays) {
+			writeError(w, http.StatusForbidden, "service_log_retention_days requires the owner role")
+			return
+		}
+	}
+
 	a, err := h.store.SetOverride(r.Context(), h.tenantID(r), r.PathValue("host"), override, h.updatedBy(r))
 	if err != nil {
 		h.writeStoreErr(w, err, "setting agent config")
@@ -259,6 +270,20 @@ func validateOverride(o ConfigOverride) error {
 	if o.LogRetentionDays != nil && (*o.LogRetentionDays < 1 || *o.LogRetentionDays > 3650) {
 		return errors.New("log_retention_days must be between 1 and 3650")
 	}
+	// 200 services is far beyond any real host's log source variety --
+	// exists only to reject a pathological/malformed request, matching
+	// extra_file_paths' own cap-for-sanity-not-realistic-use posture.
+	if len(o.ServiceLogRetentionDays) > 200 {
+		return errors.New("service_log_retention_days: at most 200 services")
+	}
+	for service, days := range o.ServiceLogRetentionDays {
+		if service == "" {
+			return errors.New("service_log_retention_days: service name must not be empty")
+		}
+		if days < 1 || days > 3650 {
+			return fmt.Errorf("service_log_retention_days[%q] must be between 1 and 3650", service)
+		}
+	}
 	return nil
 }
 
@@ -367,6 +392,30 @@ func changesLogRetentionDays(current, desired *int) bool {
 	return *current != *desired
 }
 
+// currentServiceLogRetentionDays mirrors currentLogRetentionDays exactly.
+func (h *Handler) currentServiceLogRetentionDays(ctx context.Context, tenantID, host string) map[string]int {
+	a, err := h.store.Get(ctx, tenantID, host)
+	if err != nil || a.DesiredOverride == nil {
+		return nil
+	}
+	return a.DesiredOverride.ServiceLogRetentionDays
+}
+
+// changesServiceLogRetentionDays reports whether desired differs from
+// current at all -- a full map comparison, same "no safe direction"
+// posture as changesLogRetentionDays.
+func changesServiceLogRetentionDays(current, desired map[string]int) bool {
+	if len(current) != len(desired) {
+		return true
+	}
+	for service, days := range desired {
+		if cur, ok := current[service]; !ok || cur != days {
+			return true
+		}
+	}
+	return false
+}
+
 func (h *Handler) writeStoreErr(w http.ResponseWriter, err error, action string) {
 	if errors.Is(err, ErrNotFound) {
 		writeError(w, http.StatusNotFound, "agent not found")