Scaffold Phase 0: agent -> Redpanda -> ingest -> ClickHouse -> api -> web

End-to-end log pipeline for Linux hosts, per /docs/architecture.md:

- proto: shared gRPC contract (agent <-> ingest), Go bindings checked in
- agent: Rust, musl-targeted, journald/file sourcing, RFC5424 parser,
  mTLS gRPC client, no required config for the common case
- ingest: Go, single binary with --mode server|consumer|all; gRPC front
  end forwards to Redpanda unchanged, consumer normalizes and
  batch-writes to ClickHouse with at-least-once delivery
- storage: ClickHouse schema + a plain SQL-file migration runner
- api: minimal SELECT-only query endpoint, plain REST (not gRPC+gateway
  yet -- see api/README.md)
- web: SvelteKit static SPA, one query page
- transport: Redpanda compose + topic provisioning
- cli: sentryctl ping stub
- hack/dev-certs: throwaway CA + cert generation for local mTLS
- root docker-compose.yml + docs/phase-0-runbook.md tie it together

Not yet run end-to-end against real Docker/ClickHouse/Redpanda -- see the
runbook's caveats section before relying on this working as-is.

api/internal/queryapi/validate_test.go

@@ -0,0 +1,38 @@
+package queryapi
+
+import "testing"
+
+func TestValidateSelectOnly(t *testing.T) {
+	cases := []struct {
+		name    string
+		sql     string
+		wantErr bool
+	}{
+		{"plain select", "SELECT * FROM logs LIMIT 10", false},
+		{"lowercase select", "select service, count(*) from logs group by service", false},
+		{"trailing semicolon allowed", "SELECT 1;", false},
+		{"trailing semicolon and whitespace allowed", "SELECT 1;  ", false},
+		{"empty", "", true},
+		{"whitespace only", "   ", true},
+		{"only a semicolon", ";", true},
+		{"multiple statements", "SELECT 1; SELECT 2", true},
+		{"insert", "INSERT INTO logs VALUES (1)", true},
+		{"delete", "DELETE FROM logs", true},
+		{"drop", "DROP TABLE logs", true},
+		{"select with drop keyword smuggled in", "SELECT * FROM logs WHERE message = 'DROP TABLE logs'", true},
+		{"non-select start", "WITH x AS (SELECT 1) SELECT * FROM x", true},
+		{"trailing garbage after semicolon", "SELECT 1; DROP TABLE logs", true},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := validateSelectOnly(tc.sql)
+			if tc.wantErr && err == nil {
+				t.Errorf("validateSelectOnly(%q) = nil, want error", tc.sql)
+			}
+			if !tc.wantErr && err != nil {
+				t.Errorf("validateSelectOnly(%q) = %v, want nil", tc.sql, err)
+			}
+		})
+	}
+}