feat: complete Loki query, insights, settings and deployment workflows

Add the Loki query UI, access policies, ingress insights, alert and registry settings, and their backend APIs. Include the related Kubernetes deployment and collector updates required by the integrated application.

Validated with go test ./..., npm run build, and npm run lint.

Dockerfile

@@ -55,67 +55,14 @@ FROM alpine:3.20
 # Install runtime dependencies:
 #   ca-certificates: HTTPS TLS verification
 #   openssh-client:  SSH key auth for host deployment
-#   curl:            kubectl/helm download + runtime checks
 #   bash:            Entrypoint script support
 #   wget:            HEALTHCHECK (lighter than curl)
 RUN apk --no-cache add \
     ca-certificates \
     openssh-client \
-    curl \
     bash \
     wget
 
-ARG TARGETARCH=amd64
-
-# ---- Install kubectl with checksum verification ----
-# P1: curl downloads must have integrity verification
-ENV KUBECTL_VERSION=v1.31.0
-ENV KUBECTL_SHA256_AMD64=e3c5b9c15e96cd8d70b3fdf87f38197d0b92e01fb920b5d8a40a3f4c5cb4e84a
-ENV KUBECTL_SHA256_ARM64=f9147d84b7dc0630cf4f9d7769c36e65a0885bbc0a34c5dc65b9d93c287d83b9
-RUN set -eux; \
-    if [ "$TARGETARCH" = "amd64" ]; then \
-        KUBECTL_SHA256="$KUBECTL_SHA256_AMD64"; \
-    elif [ "$TARGETARCH" = "arm64" ]; then \
-        KUBECTL_SHA256="$KUBECTL_SHA256_ARM64"; \
-    else \
-        echo "Unsupported TARGETARCH: $TARGETARCH" >&2; exit 1; \
-    fi; \
-    curl -fsSL -o /tmp/kubectl \
-        "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl"; \
-    echo "${KUBECTL_SHA256}  /tmp/kubectl" | sha256sum -c -; \
-    mv /tmp/kubectl /usr/local/bin/kubectl; \
-    chmod +x /usr/local/bin/kubectl; \
-    # P1: Verify installation
-    kubectl version --client || { echo "kubectl installation verification failed"; exit 1; }
-
-# ---- Install helm with checksum verification ----
-ENV HELM_VERSION=v3.16.3
-# Helm checksums from official releases (https://github.com/helm/helm/releases)
-# helm-v3.16.3-linux-amd64.tar.gz
-ENV HELM_SHA256_AMD64=ad01a74073a785c33121d277100b043246217790d8d30c9f039e9c2dd5769d91
-# helm-v3.16.3-linux-arm64.tar.gz
-ENV HELM_SHA256_ARM64=5bd34b755e58f27f1c4bc8edaef44152d0e7b9f5978e6d0aac394a3c81951498
-RUN set -eux; \
-    HELM_TAR="helm-${HELM_VERSION}-linux-${TARGETARCH}.tar.gz"; \
-    if [ "$TARGETARCH" = "amd64" ]; then \
-        HELM_SHA256="$HELM_SHA256_AMD64"; \
-    elif [ "$TARGETARCH" = "arm64" ]; then \
-        HELM_SHA256="$HELM_SHA256_ARM64"; \
-    else \
-        echo "Unsupported TARGETARCH: $TARGETARCH" >&2; exit 1; \
-    fi; \
-    curl -fsSL -o "/tmp/${HELM_TAR}" \
-        "https://get.helm.sh/${HELM_TAR}"; \
-    # P1: SHA256 integrity verification
-    echo "${HELM_SHA256}  /tmp/${HELM_TAR}" | sha256sum -c -; \
-    mkdir -p /tmp/helm; \
-    tar -xzf "/tmp/${HELM_TAR}" -C /tmp/helm; \
-    mv "/tmp/helm/linux-${TARGETARCH}/helm" /usr/local/bin/helm; \
-    chmod +x /usr/local/bin/helm; \
-    rm -rf /tmp/helm*; \
-    # P1: Verify installation
-    helm version --client || { echo "helm installation verification failed"; exit 1; }
-
 # ---------------------------------------------------------------
 # P0: Create non-root user and group
 # ---------------------------------------------------------------
@@ -149,7 +96,6 @@ RUN rm -rf /tmp/* /var/cache/apk/*
 ENV DATA_DIR=/app/data
 ENV SERVER_PORT=8080
 ENV KUBECONFIG=/home/opsxloki/.kube/config
-# HOME must be set for kubectl/helm to find config
 ENV HOME=/home/opsxloki
 
 # NOTE: JWT_SECRET and ENCRYPTION_KEY are NOT set here.