Scope log retention deletion and floors to (host, service), not host alone

logs rows carry a real per-record `service` (nginx, smtp, ufw, ...) --
already true of the schema (storage/migrations/0001) and wire protocol,
not something this feature invents. Both the deletion picker and the
retention floor now operate on (host, service) pairs instead of whole
hosts, so an operator can delete just one noisy log type from an agent
without touching everything else it ships, and can protect one service
(e.g. keep smtp a year) longer than the rest of that host's default.

api/agents.ConfigOverride gains ServiceLogRetentionDays (map[string]int),
owner-only to change like LogRetentionDays -- a service listed there
overrides the host's LogRetentionDays default for that service only.
Agent config page gets a matching "Per-service log retention overrides"
add/remove list next to the existing host-level field.

api/logretention: Store's count/delete now take []HostService and build
a ClickHouse tuple IN ((?,?),...) over (host, service); AgentRetentionStore.
FloorsByHost returns each host's default plus its per-service map, with
HostFloor.Effective(service) resolving which one applies. preview/delete
moved from GET/DELETE-with-query-params to POST-with-JSON-body (a list of
targets needs a real body, not a repeated compound query param), and
partitionTargets checks the floor per target so one protected service
never blocks deleting a different, unprotected one in the same request.

Settings' Log retention section is a two-level picker now: each host
row (with a "select all services" checkbox and its default floor badge)
expands to its services, each with its own count and effective
protected-days badge.

Verified live against real ClickHouse/Postgres and in-browser: a host
with a 7-day default plus a 365-day smtp override -- deleting nginx+
smtp+ufw together correctly removed nginx and ufw, left smtp's 10
records untouched, and confirmed via a follow-up owner delete that
bypassing the floor works. Also verified the full click-through (add a
service override on the agent page, see it reflected in Settings'
picker, select/preview/cancel) and confirmed no regression from the
prior host-only version's tests.

web/src/lib/api.ts

@@ -483,40 +483,47 @@ export function setUserRole(id: string, role: string): Promise<LocalUser> {
 }
 
 // --- log retention (owner/admin only, see api/logretention) -----------
-// Deletion is host-scoped, not wholesale: a caller must name which
-// hosts' logs to target (listRetentionHosts is how the UI discovers
-// what to offer), and api/logretention never treats an omitted host
-// list as "every host."
+// Deletion is scoped to specific (host, service) targets, not wholesale
+// -- a caller must name which agents' *and* which log types' logs to
+// target (listRetentionHosts is how the UI discovers what to offer,
+// grouped by host with each host's services underneath), and
+// api/logretention never treats an omitted target list as "everything."
 
-export type BlockedHost = { host: string; protected_days: number };
-export type RetentionHost = { host: string; count: number; protected_days?: number };
+export type HostService = { host: string; service: string };
+export type BlockedTarget = { host: string; service: string; protected_days: number };
+export type RetentionService = { service: string; count: number; protected_days?: number };
+export type RetentionHost = { host: string; protected_days?: number; services: RetentionService[] };
 export type RetentionHostsResult = { hosts: RetentionHost[]; cutoff: string };
-export type LogRetentionPreview = { count: number; cutoff: string; hosts: string[]; blocked_hosts?: BlockedHost[] };
+export type LogRetentionPreview = {
+	count: number;
+	cutoff: string;
+	targets: HostService[];
+	blocked_targets?: BlockedTarget[];
+};
 export type LogRetentionDeleteResult = {
 	deleted_count: number;
 	cutoff: string;
-	deleted_hosts: string[];
-	blocked_hosts?: BlockedHost[];
+	deleted_targets: HostService[];
+	blocked_targets?: BlockedTarget[];
 };
 
-function hostsQuery(hosts: string[]): string {
-	return hosts.map((h) => `host=${encodeURIComponent(h)}`).join('&');
-}
-
 export function listRetentionHosts(olderThanHours: number): Promise<RetentionHostsResult> {
 	return request(`/logs/retention/hosts?older_than_hours=${olderThanHours}`, { credentials: 'include' });
 }
 
-export function previewLogDeletion(olderThanHours: number, hosts: string[]): Promise<LogRetentionPreview> {
-	return request(`/logs/retention/preview?older_than_hours=${olderThanHours}&${hostsQuery(hosts)}`, {
-		credentials: 'include'
+export function previewLogDeletion(olderThanHours: number, targets: HostService[]): Promise<LogRetentionPreview> {
+	return request('/logs/retention/preview', {
+		method: 'POST',
+		credentials: 'include',
+		body: JSON.stringify({ older_than_hours: olderThanHours, targets })
 	});
 }
 
-export function deleteLogsOlderThan(olderThanHours: number, hosts: string[]): Promise<LogRetentionDeleteResult> {
-	return request(`/logs/retention?older_than_hours=${olderThanHours}&${hostsQuery(hosts)}`, {
-		method: 'DELETE',
-		credentials: 'include'
+export function deleteLogsOlderThan(olderThanHours: number, targets: HostService[]): Promise<LogRetentionDeleteResult> {
+	return request('/logs/retention/delete', {
+		method: 'POST',
+		credentials: 'include',
+		body: JSON.stringify({ older_than_hours: olderThanHours, targets })
 	});
 }
 
@@ -617,6 +624,11 @@ export type ConfigOverride = {
 	// reads as a protective floor, not something the agent process itself
 	// ever sees or applies.
 	log_retention_days?: number;
+	// service_log_retention_days is log_retention_days' per-service
+	// refinement, also owner-only -- a service present here overrides
+	// log_retention_days for that service only; every other service on
+	// this host still falls back to log_retention_days.
+	service_log_retention_days?: Record<string, number>;
 };
 
 export type Agent = {