Phase 1: Windows log collection + full-text search

Extends the agent, ingest, storage, api, and web with Windows Event
Log/ETW sourcing and Tantivy-backed free-text search, per the approved
Phase 1 plan.

- CLAUDE.md: materialized on disk (never existed as a file before) with
  a new Phase 1 "done looks like" section.
- agent: Windows Event Log (EvtSubscribe) and ETW sources, Windows
  service wrapper (install/uninstall/run-service), both feature- and
  target_os-gated so Linux builds/tests/clippy stay unaffected. Also
  fixed two pre-existing Phase 0 clippy gaps (dead-code on
  default-features-only builds, a type-inference edge case) found while
  testing every feature combination properly for the first time.
  UNVERIFIED on real Windows -- no Windows toolchain existed anywhere in
  the build environment; flagged prominently in three places.
- proto/ingest: new record_id field, assigned once server-side in
  ingest's gRPC front end so ClickHouse and Tantivy agree on the same ID
  for the same record.
- storage: record_id column + bloom filter index, verified against a
  live ClickHouse.
- search: new service, Tantivy index, rskafka consumer as an independent
  second consumer group on the same Redpanda topic ingest already reads.
- api/web: new /search endpoint and page, sharing the query page's
  result-table shape and component.
- hack/windows-fixture: sends realistic Windows-shaped data straight to
  ingest, so the pipeline's handling of it is verifiable without a
  Windows host.

Verified end-to-end on the live docker-compose stack: the same record_id
comes back from both /query and /search for the same log line, including
for windows-fixture's synthetic Windows Event Log data. Real bugs found
and fixed along the way: api/Dockerfile missing proto/ in its build
context, search's logs being completely silent (RUST_LOG gap), and
search/target/ missing from .gitignore/.dockerignore.

agent/sentry-agent/config/agent.example.toml

@@ -1,25 +1,39 @@
-# Example sentry-agent config. Copy to /etc/sentry-agent/agent.toml, or
-# pass --config /path/to/this/file.
+# Example sentry-agent config. Copy to the platform's conventional path
+# (/etc/sentry-agent/agent.toml on Linux, C:\ProgramData\SentryAgent\agent.toml
+# on Windows), or pass --config /path/to/this/file.
 #
 # Every field has a built-in default (see src/config.rs), so this file only
 # needs to contain what you're overriding. An agent with NO config file at
-# all still runs: it defaults to journald, service = "default", and expects
-# mTLS material at /etc/sentry-agent/{ca,client,client-key}.pem.
+# all still runs: on Linux it defaults to journald, service = "default",
+# and expects mTLS material at /etc/sentry-agent/{ca,client,client-key}.pem
+# (Windows equivalents under C:\ProgramData\SentryAgent\).
 
 [agent]
-# host = "explicit-hostname-override"   # defaults to /etc/hostname
+# host = "explicit-hostname-override"   # defaults to /etc/hostname (Linux) or %COMPUTERNAME% (Windows)
 service = "my-service"
 
 [source]
 kind = "journald"
 # unit = "nginx.service"                # omit to tail the whole journal
 
-# To tail a file instead:
+# To tail a file instead (works on both Linux and Windows):
 # [source]
 # kind = "file"
 # path = "/var/log/nginx/access.log"
 # from_beginning = false
 
+# Windows Event Log (requires the agent to be built with the
+# `windows-eventlog` feature — see /agent/README.md):
+# [source]
+# kind = "eventlog"
+# channels = ["Application", "System", "Security"]   # this is the default if omitted
+
+# ETW (requires the `etw` feature, and usually elevated privileges — read
+# /agent/README.md's privilege section before enabling this):
+# [source]
+# kind = "etw"
+# providers = ["{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}"]   # GUIDs, not friendly names
+
 [batch]
 max_size = 500
 flush_interval_ms = 2000