Scaffold Phase 0: agent -> Redpanda -> ingest -> ClickHouse -> api -> web

End-to-end log pipeline for Linux hosts, per /docs/architecture.md:

- proto: shared gRPC contract (agent <-> ingest), Go bindings checked in
- agent: Rust, musl-targeted, journald/file sourcing, RFC5424 parser,
  mTLS gRPC client, no required config for the common case
- ingest: Go, single binary with --mode server|consumer|all; gRPC front
  end forwards to Redpanda unchanged, consumer normalizes and
  batch-writes to ClickHouse with at-least-once delivery
- storage: ClickHouse schema + a plain SQL-file migration runner
- api: minimal SELECT-only query endpoint, plain REST (not gRPC+gateway
  yet -- see api/README.md)
- web: SvelteKit static SPA, one query page
- transport: Redpanda compose + topic provisioning
- cli: sentryctl ping stub
- hack/dev-certs: throwaway CA + cert generation for local mTLS
- root docker-compose.yml + docs/phase-0-runbook.md tie it together

Not yet run end-to-end against real Docker/ClickHouse/Redpanda -- see the
runbook's caveats section before relying on this working as-is.

api/internal/config/config.go

@@ -0,0 +1,56 @@
+// Package config loads api's configuration from environment variables,
+// same convention as /ingest: no config file format for Phase 0.
+package config
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+	"time"
+)
+
+type Config struct {
+	HTTPListenAddr    string
+	ClickHouse        ClickHouseConfig
+	QueryTimeout      time.Duration
+	CORSAllowedOrigin string
+}
+
+type ClickHouseConfig struct {
+	Addr     string
+	Database string
+	Username string
+	Password string
+}
+
+func Load() (Config, error) {
+	cfg := Config{
+		HTTPListenAddr: getenv("HTTP_LISTEN_ADDR", ":8080"),
+		ClickHouse: ClickHouseConfig{
+			Addr:     getenv("CLICKHOUSE_ADDR", "localhost:9000"),
+			Database: getenv("CLICKHOUSE_DATABASE", "sentry"),
+			Username: getenv("CLICKHOUSE_USERNAME", "default"),
+			Password: getenv("CLICKHOUSE_PASSWORD", ""),
+		},
+		// Phase 0 has no auth, so this is wide open by default to keep
+		// the local SvelteKit dev server (a different origin/port)
+		// working out of the box. Tighten before this is ever reachable
+		// from outside a trusted dev/homelab network.
+		CORSAllowedOrigin: getenv("CORS_ALLOWED_ORIGIN", "*"),
+	}
+
+	timeoutSec, err := strconv.Atoi(getenv("QUERY_TIMEOUT_SECONDS", "30"))
+	if err != nil {
+		return Config{}, fmt.Errorf("QUERY_TIMEOUT_SECONDS: %w", err)
+	}
+	cfg.QueryTimeout = time.Duration(timeoutSec) * time.Second
+
+	return cfg, nil
+}
+
+func getenv(key, fallback string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return fallback
+}

api/internal/config/config_test.go

@@ -0,0 +1,29 @@
+package config
+
+import (
+	"testing"
+	"time"
+)
+
+func TestLoadDefaults(t *testing.T) {
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+	if cfg.HTTPListenAddr != ":8080" {
+		t.Errorf("HTTPListenAddr = %q, want :8080", cfg.HTTPListenAddr)
+	}
+	if cfg.QueryTimeout != 30*time.Second {
+		t.Errorf("QueryTimeout = %v, want 30s", cfg.QueryTimeout)
+	}
+	if cfg.CORSAllowedOrigin != "*" {
+		t.Errorf("CORSAllowedOrigin = %q, want *", cfg.CORSAllowedOrigin)
+	}
+}
+
+func TestLoadInvalidTimeoutErrors(t *testing.T) {
+	t.Setenv("QUERY_TIMEOUT_SECONDS", "not-a-number")
+	if _, err := Load(); err == nil {
+		t.Fatal("expected error for non-numeric QUERY_TIMEOUT_SECONDS, got nil")
+	}
+}