Phase 1: Windows log collection + full-text search

Extends the agent, ingest, storage, api, and web with Windows Event
Log/ETW sourcing and Tantivy-backed free-text search, per the approved
Phase 1 plan.

- CLAUDE.md: materialized on disk (never existed as a file before) with
  a new Phase 1 "done looks like" section.
- agent: Windows Event Log (EvtSubscribe) and ETW sources, Windows
  service wrapper (install/uninstall/run-service), both feature- and
  target_os-gated so Linux builds/tests/clippy stay unaffected. Also
  fixed two pre-existing Phase 0 clippy gaps (dead-code on
  default-features-only builds, a type-inference edge case) found while
  testing every feature combination properly for the first time.
  UNVERIFIED on real Windows -- no Windows toolchain existed anywhere in
  the build environment; flagged prominently in three places.
- proto/ingest: new record_id field, assigned once server-side in
  ingest's gRPC front end so ClickHouse and Tantivy agree on the same ID
  for the same record.
- storage: record_id column + bloom filter index, verified against a
  live ClickHouse.
- search: new service, Tantivy index, rskafka consumer as an independent
  second consumer group on the same Redpanda topic ingest already reads.
- api/web: new /search endpoint and page, sharing the query page's
  result-table shape and component.
- hack/windows-fixture: sends realistic Windows-shaped data straight to
  ingest, so the pipeline's handling of it is verifiable without a
  Windows host.

Verified end-to-end on the live docker-compose stack: the same record_id
comes back from both /query and /search for the same log line, including
for windows-fixture's synthetic Windows Event Log data. Real bugs found
and fixed along the way: api/Dockerfile missing proto/ in its build
context, search's logs being completely silent (RUST_LOG gap), and
search/target/ missing from .gitignore/.dockerignore.

api/internal/queryapi/search.go

@@ -0,0 +1,96 @@
+package queryapi
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/google/uuid"
+)
+
+// searchClient is the narrow interface handleSearch depends on, so tests
+// can substitute a fake without a real search service. A small gRPC
+// adapter in cmd/api satisfies this.
+type searchClient interface {
+	Search(ctx context.Context, query string, limit uint32) ([]string, error)
+}
+
+type searchRequest struct {
+	Query string `json:"query"`
+	Limit uint32 `json:"limit"`
+}
+
+func (h *Handler) handleSearch(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, maxBodyBytes)
+
+	var req searchRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid JSON body: "+err.Error())
+		return
+	}
+	if strings.TrimSpace(req.Query) == "" {
+		writeError(w, http.StatusBadRequest, "query must not be empty")
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), h.queryTimeout)
+	defer cancel()
+
+	recordIDs, err := h.search.Search(ctx, req.Query, req.Limit)
+	if err != nil {
+		h.logger.Error("search failed", "error", err)
+		writeError(w, http.StatusBadGateway, "search failed: "+err.Error())
+		return
+	}
+
+	if len(recordIDs) == 0 {
+		writeJSON(w, &QueryResult{Columns: []string{}, Rows: [][]any{}})
+		return
+	}
+
+	sql, err := recordIDsQuery(recordIDs)
+	if err != nil {
+		h.logger.Error("building record_id query", "error", err)
+		writeError(w, http.StatusBadGateway, "search returned unusable results")
+		return
+	}
+
+	result, err := h.exec.Execute(ctx, sql)
+	if err != nil {
+		h.logger.Error("joining search results against clickhouse failed", "error", err)
+		writeError(w, http.StatusBadGateway, "query failed: "+err.Error())
+		return
+	}
+
+	writeJSON(w, result)
+}
+
+// recordIDsQuery builds a SELECT ... WHERE record_id IN (...) against the
+// IDs the search service returned. Every ID is validated as a real UUID
+// before being embedded in the query string -- record_ids come from an
+// internal, trusted service (not raw user input), but a UUID that fails
+// to parse can't contain SQL-breaking characters either way, so this is
+// defense in depth, not a response to a specific threat.
+func recordIDsQuery(recordIDs []string) (string, error) {
+	quoted := make([]string, 0, len(recordIDs))
+	for _, id := range recordIDs {
+		if _, err := uuid.Parse(id); err != nil {
+			continue // skip anything not a valid UUID rather than failing the whole query
+		}
+		quoted = append(quoted, "'"+id+"'")
+	}
+	if len(quoted) == 0 {
+		return "", fmt.Errorf("no valid record_ids in search response")
+	}
+	return fmt.Sprintf(
+		"SELECT * FROM logs WHERE record_id IN (%s) ORDER BY timestamp DESC",
+		strings.Join(quoted, ","),
+	), nil
+}
+
+func writeJSON(w http.ResponseWriter, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(v)
+}