Scope log retention deletion and floors to (host, service), not host alone

logs rows carry a real per-record `service` (nginx, smtp, ufw, ...) --
already true of the schema (storage/migrations/0001) and wire protocol,
not something this feature invents. Both the deletion picker and the
retention floor now operate on (host, service) pairs instead of whole
hosts, so an operator can delete just one noisy log type from an agent
without touching everything else it ships, and can protect one service
(e.g. keep smtp a year) longer than the rest of that host's default.

api/agents.ConfigOverride gains ServiceLogRetentionDays (map[string]int),
owner-only to change like LogRetentionDays -- a service listed there
overrides the host's LogRetentionDays default for that service only.
Agent config page gets a matching "Per-service log retention overrides"
add/remove list next to the existing host-level field.

api/logretention: Store's count/delete now take []HostService and build
a ClickHouse tuple IN ((?,?),...) over (host, service); AgentRetentionStore.
FloorsByHost returns each host's default plus its per-service map, with
HostFloor.Effective(service) resolving which one applies. preview/delete
moved from GET/DELETE-with-query-params to POST-with-JSON-body (a list of
targets needs a real body, not a repeated compound query param), and
partitionTargets checks the floor per target so one protected service
never blocks deleting a different, unprotected one in the same request.

Settings' Log retention section is a two-level picker now: each host
row (with a "select all services" checkbox and its default floor badge)
expands to its services, each with its own count and effective
protected-days badge.

Verified live against real ClickHouse/Postgres and in-browser: a host
with a 7-day default plus a 365-day smtp override -- deleting nginx+
smtp+ufw together correctly removed nginx and ufw, left smtp's 10
records untouched, and confirmed via a follow-up owner delete that
bypassing the floor works. Also verified the full click-through (add a
service override on the agent page, see it reflected in Settings'
picker, select/preview/cancel) and confirmed no regression from the
prior host-only version's tests.

api/agents/store.go

@@ -53,6 +53,19 @@ type ConfigOverride struct {
 	// an agent" is exactly what it conceptually is, even though nothing
 	// ever ships it to the agent process itself.
 	LogRetentionDays *int `json:"log_retention_days,omitempty"`
+	// ServiceLogRetentionDays is LogRetentionDays' per-service refinement:
+	// this host's `logs` rows are tagged with a `service` value (e.g.
+	// "nginx", "smtp", "ufw" -- see storage/migrations/0001_create_logs_table.sql
+	// and /docs/agent-management-design.md's note that distinct services
+	// on one host come from running separate agent processes, each with
+	// its own agent.toml `service`), and an operator may want to keep one
+	// service's logs longer than the rest of the host's default. A
+	// service present here overrides LogRetentionDays for that service
+	// only; every other service on the host still falls back to
+	// LogRetentionDays (or no floor at all if that's unset too). Same
+	// "never shipped to the agent process, central policy metadata only"
+	// posture as LogRetentionDays -- see logretention.AgentRetentionStore.
+	ServiceLogRetentionDays map[string]int `json:"service_log_retention_days,omitempty"`
 }
 
 type Agent struct {