Scaffold Phase 0: agent -> Redpanda -> ingest -> ClickHouse -> api -> web

End-to-end log pipeline for Linux hosts, per /docs/architecture.md:

- proto: shared gRPC contract (agent <-> ingest), Go bindings checked in
- agent: Rust, musl-targeted, journald/file sourcing, RFC5424 parser,
  mTLS gRPC client, no required config for the common case
- ingest: Go, single binary with --mode server|consumer|all; gRPC front
  end forwards to Redpanda unchanged, consumer normalizes and
  batch-writes to ClickHouse with at-least-once delivery
- storage: ClickHouse schema + a plain SQL-file migration runner
- api: minimal SELECT-only query endpoint, plain REST (not gRPC+gateway
  yet -- see api/README.md)
- web: SvelteKit static SPA, one query page
- transport: Redpanda compose + topic provisioning
- cli: sentryctl ping stub
- hack/dev-certs: throwaway CA + cert generation for local mTLS
- root docker-compose.yml + docs/phase-0-runbook.md tie it together

Not yet run end-to-end against real Docker/ClickHouse/Redpanda -- see the
runbook's caveats section before relying on this working as-is.

agent/sentry-agent/config/agent.example.toml

@@ -0,0 +1,33 @@
+# Example sentry-agent config. Copy to /etc/sentry-agent/agent.toml, or
+# pass --config /path/to/this/file.
+#
+# Every field has a built-in default (see src/config.rs), so this file only
+# needs to contain what you're overriding. An agent with NO config file at
+# all still runs: it defaults to journald, service = "default", and expects
+# mTLS material at /etc/sentry-agent/{ca,client,client-key}.pem.
+
+[agent]
+# host = "explicit-hostname-override"   # defaults to /etc/hostname
+service = "my-service"
+
+[source]
+kind = "journald"
+# unit = "nginx.service"                # omit to tail the whole journal
+
+# To tail a file instead:
+# [source]
+# kind = "file"
+# path = "/var/log/nginx/access.log"
+# from_beginning = false
+
+[batch]
+max_size = 500
+flush_interval_ms = 2000
+
+[ingest]
+endpoint = "https://ingest.internal:4317"
+
+[tls]
+ca_cert = "/etc/sentry-agent/ca.pem"
+client_cert = "/etc/sentry-agent/client.pem"
+client_key = "/etc/sentry-agent/client-key.pem"