Phase 3: dashboards and alerting

Saved, shareable multi-panel dashboards (table/line/bar/single-stat
panels via gridstack + uPlot, global + per-panel time range, JSON
export/import) and threshold/absence alert rules with an
ok/pending/firing evaluator and webhook/Slack/PagerDuty delivery.

- New /metadata component: Postgres control-plane store for dashboards,
  panels, notification targets, alert rules/state, and delivery log --
  see docs/phase-3-dashboard-design.md for why ClickHouse's MergeTree
  family isn't a fit for this access pattern (needs real row-level
  locking and read-your-writes consistency).
- api/internal/dashboards: dashboard/panel CRUD, pure -- panel query
  execution stays client-side, reusing the existing /query endpoint.
- New /alerting service: rule/target CRUD, a ticker-driven evaluator
  (claim-then-evaluate concurrency control, transactional-outbox
  delivery, query errors and threshold zero-rows never coerced into a
  false transition) and webhook/Slack/PagerDuty delivery with
  retry/backoff. See docs/phase-3-alerting-design.md for the full
  state-machine design and the four correctness properties it
  implements.
- web: /dashboards and /alerts UIs; cli: sentryctl dashboards/alerts
  list/get/apply, seeding a future Terraform provider's JSON contract.
- hack/alert-load-test: 500 rules against real ClickHouse data, real
  measured results in docs/phase-3-runbook.md.

Five real bugs found by actually running this against a live stack
(documented in the runbook, not just fixed silently): a latent Phase 2
bug where ClickHouse rejected the timestamp format used for
earliest=/latest= queries; a "now" literal token injected into query
text; a GridStack/uPlot layout-timing race; JS's Date.parse being too
lenient to use as a timestamp-detection heuristic; a rule's "enabled"
field silently defaulting to false when omitted; and the evaluator's
claim-batch-size and worker-pool-concurrency defaulting to the same
value, causing 500 concurrently-due rules to take 125s to cycle through
instead of the configured 60s.

cli/cmd/sentryctl/cmd_query.go

@@ -0,0 +1,112 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+)
+
+type queryArgs struct {
+	apiURL   string
+	jsonOut  bool
+	language string
+	query    string
+}
+
+// parseQueryArgs is pure (env passed in, no I/O), same testability
+// reasoning as parsePingArgs. Non-flag arguments are joined with spaces
+// to form the query, so `sentryctl query service=api status=500` (no
+// quotes, no shell-special characters) works without requiring users to
+// quote every query -- though anything using "|" still needs shell
+// quoting regardless, since that's a real shell pipe character otherwise.
+func parseQueryArgs(args []string, env func(string) string) queryArgs {
+	qa := queryArgs{apiURL: resolveAPIURL(env)}
+	var rest []string
+	for i := 0; i < len(args); i++ {
+		switch args[i] {
+		case "--api":
+			if i+1 < len(args) {
+				qa.apiURL = args[i+1]
+				i++
+			}
+		case "--json":
+			qa.jsonOut = true
+		case "--language":
+			if i+1 < len(args) {
+				qa.language = args[i+1]
+				i++
+			}
+		default:
+			rest = append(rest, args[i])
+		}
+	}
+	qa.query = strings.Join(rest, " ")
+	return qa
+}
+
+type queryRequestBody struct {
+	Query    string `json:"query"`
+	Language string `json:"language"`
+}
+
+type queryResponseBody struct {
+	Columns []string `json:"columns"`
+	Rows    [][]any  `json:"rows"`
+}
+
+func cmdQuery(args []string, stdout, stderr io.Writer) int {
+	qa := parseQueryArgs(args, os.Getenv)
+	if strings.TrimSpace(qa.query) == "" {
+		fmt.Fprintln(stderr, "sentryctl query: missing query string")
+		return 1
+	}
+
+	reqBody, err := json.Marshal(queryRequestBody{Query: qa.query, Language: qa.language})
+	if err != nil {
+		fmt.Fprintf(stderr, "encoding request: %v\n", err)
+		return 1
+	}
+
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Post(qa.apiURL+"/query", "application/json", bytes.NewReader(reqBody))
+	if err != nil {
+		fmt.Fprintf(stderr, "query failed: %v\n", err)
+		return 1
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		fmt.Fprintf(stderr, "reading response: %v\n", err)
+		return 1
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		var errResp errorResponseBody
+		if json.Unmarshal(respBody, &errResp) == nil && errResp.Error != "" {
+			fmt.Fprintf(stderr, "query failed: %s\n", errResp.Error)
+		} else {
+			fmt.Fprintf(stderr, "query failed: api returned status %d\n", resp.StatusCode)
+		}
+		return 1
+	}
+
+	if qa.jsonOut {
+		_, _ = stdout.Write(respBody)
+		fmt.Fprintln(stdout)
+		return 0
+	}
+
+	var result queryResponseBody
+	if err := json.Unmarshal(respBody, &result); err != nil {
+		fmt.Fprintf(stderr, "decoding response: %v\n", err)
+		return 1
+	}
+	printTable(stdout, result.Columns, result.Rows)
+	return 0
+}