Add logviewer: web UI for the ClickHouse log store

Single Go binary with embedded Bootstrap 3 + jQuery UI, querying logs.raw
over the ClickHouse HTTP interface as the readonly logreader user. Runs
behind oauth2-proxy; the app does no auth itself. Server-side enforced
time bounds (15m default, 72h max), parameterized queries, raw-SQL WHERE
fragment wrapped with enforced bounds and LIMIT, tail polling with a
clamped cursor, facets, healthz. Woodpecker build/test plus tag-driven
image push to artifactapi docker-internal.

main.go

@@ -0,0 +1,47 @@
+package main
+
+import (
+	"log"
+	"net/http"
+	"os"
+	"time"
+
+	"git.unkin.net/unkin/logviewer/internal/server"
+)
+
+var version = "dev"
+
+func envOr(key, def string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return def
+}
+
+func main() {
+	chURL := envOr("CH_URL", "http://clickhouse-logs.logging.svc.cluster.local:8123")
+	chUser := envOr("CH_USER", "logreader")
+	chPassword := os.Getenv("CH_PASSWORD")
+	addr := envOr("LISTEN_ADDR", ":8080")
+
+	srv := server.New(server.Config{
+		CHURL:      chURL,
+		CHUser:     chUser,
+		CHPassword: chPassword,
+		Version:    version,
+	})
+
+	hs := &http.Server{
+		Addr:              addr,
+		Handler:           srv,
+		ReadHeaderTimeout: 10 * time.Second,
+		ReadTimeout:       60 * time.Second,
+		WriteTimeout:      60 * time.Second,
+		IdleTimeout:       120 * time.Second,
+	}
+
+	log.Printf("logviewer %s listening on %s (clickhouse %s as %s)", version, addr, chURL, chUser)
+	if err := hs.ListenAndServe(); err != nil {
+		log.Fatal(err)
+	}
+}