Scaffold Phase 0: agent -> Redpanda -> ingest -> ClickHouse -> api -> web

End-to-end log pipeline for Linux hosts, per /docs/architecture.md:

- proto: shared gRPC contract (agent <-> ingest), Go bindings checked in
- agent: Rust, musl-targeted, journald/file sourcing, RFC5424 parser,
  mTLS gRPC client, no required config for the common case
- ingest: Go, single binary with --mode server|consumer|all; gRPC front
  end forwards to Redpanda unchanged, consumer normalizes and
  batch-writes to ClickHouse with at-least-once delivery
- storage: ClickHouse schema + a plain SQL-file migration runner
- api: minimal SELECT-only query endpoint, plain REST (not gRPC+gateway
  yet -- see api/README.md)
- web: SvelteKit static SPA, one query page
- transport: Redpanda compose + topic provisioning
- cli: sentryctl ping stub
- hack/dev-certs: throwaway CA + cert generation for local mTLS
- root docker-compose.yml + docs/phase-0-runbook.md tie it together

Not yet run end-to-end against real Docker/ClickHouse/Redpanda -- see the
runbook's caveats section before relying on this working as-is.

ingest/internal/normalize/normalize.go

@@ -0,0 +1,58 @@
+// Package normalize maps the wire-format LogRecord (as agents send it)
+// into the ClickHouse row shape defined in /storage. This is the "OTel-log-
+// like schema" normalization step called for in the ingest design — Phase
+// 0 keeps it to the minimal column set; full OTel field mapping (separate
+// SeverityNumber/SeverityText, resource attributes, etc.) is deferred, see
+// the open questions in /docs/architecture.md.
+package normalize
+
+import (
+	"time"
+
+	logsv1 "github.com/sentry/sentry/proto/sentry/logs/v1"
+)
+
+type Row struct {
+	Timestamp  time.Time
+	Host       string
+	Service    string
+	Severity   string
+	Message    string
+	Attributes map[string]string
+}
+
+func ToRow(rec *logsv1.LogRecord) Row {
+	attrs := rec.GetAttributes()
+	if attrs == nil {
+		attrs = map[string]string{}
+	}
+	return Row{
+		Timestamp:  time.Unix(0, rec.GetTimestampUnixNano()).UTC(),
+		Host:       rec.GetHost(),
+		Service:    rec.GetService(),
+		Severity:   severityText(rec.GetSeverity()),
+		Message:    rec.GetMessage(),
+		Attributes: attrs,
+	}
+}
+
+// severityText maps the proto Severity enum to short OTel-style severity
+// names, stored as the `severity` column's value.
+func severityText(sev logsv1.Severity) string {
+	switch sev {
+	case logsv1.Severity_SEVERITY_TRACE:
+		return "TRACE"
+	case logsv1.Severity_SEVERITY_DEBUG:
+		return "DEBUG"
+	case logsv1.Severity_SEVERITY_INFO:
+		return "INFO"
+	case logsv1.Severity_SEVERITY_WARN:
+		return "WARN"
+	case logsv1.Severity_SEVERITY_ERROR:
+		return "ERROR"
+	case logsv1.Severity_SEVERITY_FATAL:
+		return "FATAL"
+	default:
+		return "UNSPECIFIED"
+	}
+}