Phase 2: unified query language spanning ClickHouse and Tantivy

Replaces the separate SQL-only /query and text-only /search endpoints
with one pipe-syntax query language (plus raw SQL escape hatch) that
compiles to a single IR and execution plan across both backends, so a
query like `message:"connection refused" | stats count by host` runs
as one request instead of two disjoint tools.

- api/internal/querylang: lexer -> ast -> parser -> ir -> planner ->
  executor, each layer independently tested.
- Execution generalizes Phase 1's proven Tantivy-prefilter pattern
  into a 4-way routing table (pure ClickHouse / text-only / text +
  aggregation / raw SQL passthrough).
- Unified web query page and `sentryctl query`, both hitting the same
  POST /query endpoint.
- Benchmarked against a real 1,022,000-row dataset
  (hack/benchmark-fixture); caught and fixed a real bug where the
  Tantivy prefilter cap (10,000) produced an IN-clause exceeding
  ClickHouse's default max_query_size -- lowered to 5,000, documented
  in docs/query-language-design.md and docs/phase-2-runbook.md.
- docs/query-language-reference.md: customer-facing syntax reference.

cli/README.md

@@ -1,6 +1,6 @@
 # sentryctl
 
-Sentry's control CLI. Phase 0: a single command.
+Sentry's control CLI.
 
 ```sh
 sentryctl ping                              # checks http://localhost:8080/healthz
@@ -11,9 +11,24 @@ SENTRYCTL_API_URL=http://api.internal:8080 sentryctl ping
 Exits 0 and prints `ok` if `/api`'s `/healthz` responds 200; exits 1 with an
 error on `stderr` otherwise.
 
-No CLI framework (cobra/urfave-cli/etc.) — a single command doesn't need
-one, and stdlib `os.Args` handling is boring enough not to need a
-dependency. Revisit once there's a real command tree to justify one.
+```sh
+sentryctl query 'service=api | where status>=500 | stats count by host'
+sentryctl query 'SELECT * FROM logs LIMIT 10' --language sql
+sentryctl query 'message:"connection refused"' --json
+```
+
+Quote the query in your shell — pipe syntax uses `|`, which your shell
+interprets as an actual pipe if you don't. Hits the exact same `POST
+/query` endpoint the web UI does (`internal/querylang` in `/api` does the
+compiling; there's no separate query logic here to drift out of sync —
+see `/docs/query-language-reference.md`). `--language` overrides
+auto-detection, same optional override the HTTP API itself exposes.
+Prints a table by default (stdlib `text/tabwriter`, no new dependency);
+`--json` prints the raw `{columns, rows}` response instead.
+
+No CLI framework (cobra/urfave-cli/etc.) — two commands don't need one,
+and stdlib `os.Args` handling is boring enough not to need a dependency.
+Revisit once there's a real command tree to justify one.
 
 ## Building & testing