Phase 1: Windows log collection + full-text search

Extends the agent, ingest, storage, api, and web with Windows Event
Log/ETW sourcing and Tantivy-backed free-text search, per the approved
Phase 1 plan.

- CLAUDE.md: materialized on disk (never existed as a file before) with
  a new Phase 1 "done looks like" section.
- agent: Windows Event Log (EvtSubscribe) and ETW sources, Windows
  service wrapper (install/uninstall/run-service), both feature- and
  target_os-gated so Linux builds/tests/clippy stay unaffected. Also
  fixed two pre-existing Phase 0 clippy gaps (dead-code on
  default-features-only builds, a type-inference edge case) found while
  testing every feature combination properly for the first time.
  UNVERIFIED on real Windows -- no Windows toolchain existed anywhere in
  the build environment; flagged prominently in three places.
- proto/ingest: new record_id field, assigned once server-side in
  ingest's gRPC front end so ClickHouse and Tantivy agree on the same ID
  for the same record.
- storage: record_id column + bloom filter index, verified against a
  live ClickHouse.
- search: new service, Tantivy index, rskafka consumer as an independent
  second consumer group on the same Redpanda topic ingest already reads.
- api/web: new /search endpoint and page, sharing the query page's
  result-table shape and component.
- hack/windows-fixture: sends realistic Windows-shaped data straight to
  ingest, so the pipeline's handling of it is verifiable without a
  Windows host.

Verified end-to-end on the live docker-compose stack: the same record_id
comes back from both /query and /search for the same log line, including
for windows-fixture's synthetic Windows Event Log data. Real bugs found
and fixed along the way: api/Dockerfile missing proto/ in its build
context, search's logs being completely silent (RUST_LOG gap), and
search/target/ missing from .gitignore/.dockerignore.

api/internal/queryapi/handler.go

@@ -1,13 +1,13 @@
-// Package queryapi is the Phase 0 query API: a single crude POST /query
-// endpoint that takes a raw SQL string, allowlists it to a single SELECT
-// statement, and proxies it to ClickHouse. This is a deliberate
-// simplification of the pinned "gRPC + REST gateway" control-plane
-// pattern (see CLAUDE.md's tech stack table): a plain net/http REST
-// handler, not a gRPC service transcoded through grpc-gateway. That
-// machinery (proto definitions, googleapis annotations, gateway codegen)
-// buys nothing for one crude placeholder endpoint that Phase 2 replaces
-// outright with the real SPL-like query layer. Revisit gRPC+gateway when
-// /api grows a second real endpoint.
+// Package queryapi is Sentry's query API: POST /query (Phase 0, a crude
+// raw-SQL passthrough allowlisted to SELECT) and POST /search (Phase 1,
+// free-text search via the search service, joined back against
+// ClickHouse). This is a deliberate simplification of the pinned "gRPC +
+// REST gateway" control-plane pattern (see CLAUDE.md's tech stack table):
+// plain net/http REST handlers, not a gRPC service transcoded through
+// grpc-gateway. That machinery (proto definitions, googleapis
+// annotations, gateway codegen) doesn't buy much for two crude endpoints
+// that Phase 2's real SPL-like query layer replaces outright. Revisit
+// gRPC+gateway once /api's endpoint count and lifespan justify it.
 package queryapi
 
 import (
@@ -28,17 +28,19 @@ type queryExecutor interface {
 type Handler struct {
 	logger        *slog.Logger
 	exec          queryExecutor
+	search        searchClient
 	queryTimeout  time.Duration
 	allowedOrigin string
 }
 
-func NewHandler(logger *slog.Logger, exec queryExecutor, queryTimeout time.Duration, allowedOrigin string) *Handler {
-	return &Handler{logger: logger, exec: exec, queryTimeout: queryTimeout, allowedOrigin: allowedOrigin}
+func NewHandler(logger *slog.Logger, exec queryExecutor, search searchClient, queryTimeout time.Duration, allowedOrigin string) *Handler {
+	return &Handler{logger: logger, exec: exec, search: search, queryTimeout: queryTimeout, allowedOrigin: allowedOrigin}
 }
 
 func (h *Handler) Routes() http.Handler {
 	mux := http.NewServeMux()
 	mux.HandleFunc("POST /query", h.handleQuery)
+	mux.HandleFunc("POST /search", h.handleSearch)
 	mux.HandleFunc("GET /healthz", h.handleHealthz)
 	return h.withCORS(mux)
 }
@@ -99,10 +101,7 @@ func (h *Handler) handleQuery(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(result); err != nil {
-		h.logger.Error("encoding response", "error", err)
-	}
+	writeJSON(w, result)
 }
 
 func writeError(w http.ResponseWriter, status int, msg string) {