Scaffold Phase 0: agent -> Redpanda -> ingest -> ClickHouse -> api -> web

End-to-end log pipeline for Linux hosts, per /docs/architecture.md:

- proto: shared gRPC contract (agent <-> ingest), Go bindings checked in
- agent: Rust, musl-targeted, journald/file sourcing, RFC5424 parser,
  mTLS gRPC client, no required config for the common case
- ingest: Go, single binary with --mode server|consumer|all; gRPC front
  end forwards to Redpanda unchanged, consumer normalizes and
  batch-writes to ClickHouse with at-least-once delivery
- storage: ClickHouse schema + a plain SQL-file migration runner
- api: minimal SELECT-only query endpoint, plain REST (not gRPC+gateway
  yet -- see api/README.md)
- web: SvelteKit static SPA, one query page
- transport: Redpanda compose + topic provisioning
- cli: sentryctl ping stub
- hack/dev-certs: throwaway CA + cert generation for local mTLS
- root docker-compose.yml + docs/phase-0-runbook.md tie it together

Not yet run end-to-end against real Docker/ClickHouse/Redpanda -- see the
runbook's caveats section before relying on this working as-is.

cli/README.md

@@ -0,0 +1,28 @@
+# sentryctl
+
+Sentry's control CLI. Phase 0: a single command.
+
+```sh
+sentryctl ping                              # checks http://localhost:8080/healthz
+sentryctl ping --api http://api.internal:8080
+SENTRYCTL_API_URL=http://api.internal:8080 sentryctl ping
+```
+
+Exits 0 and prints `ok` if `/api`'s `/healthz` responds 200; exits 1 with an
+error on `stderr` otherwise.
+
+No CLI framework (cobra/urfave-cli/etc.) — a single command doesn't need
+one, and stdlib `os.Args` handling is boring enough not to need a
+dependency. Revisit once there's a real command tree to justify one.
+
+## Building & testing
+
+```sh
+go build ./...
+go vet ./...
+go test ./...
+```
+
+```sh
+docker build -f Dockerfile -t sentryctl .   # context is cli/, not the repo root
+```