feat: complete Loki query, insights, settings and deployment workflows

Add the Loki query UI, access policies, ingress insights, alert and registry settings, and their backend APIs. Include the related Kubernetes deployment and collector updates required by the integrated application.

Validated with go test ./..., npm run build, and npm run lint.

backend/controllers/logs.go

@@ -2,7 +2,6 @@ package controllers
 
 import (
 	"context"
-	"encoding/json"
 	"strconv"
 	"strings"
 	"time"
@@ -30,27 +29,23 @@ func (ctrl *LogsController) Context(c *gin.Context) {
 		utils.BadRequest(c, "时间戳无效")
 		return
 	}
-	parts := make([]string, 0, len(req.Labels))
-	for key, value := range req.Labels {
-		if !services.ValidLogLabelName(key) {
-			utils.BadRequest(c, "标签名无效")
-			return
-		}
-		encoded, _ := json.Marshal(value)
-		parts = append(parts, key+"="+string(encoded))
+	selector, err := services.ContextLogSelector(req.Labels)
+	if err != nil {
+		utils.BadRequest(c, err.Error())
+		return
 	}
-	query, err := services.AuthorizedLogQuery(src, c.GetUint("userId"), c.GetString("role") == "admin", "{"+strings.Join(parts, ",")+"}")
+	query, err := services.AuthorizedLogQuery(src, c.GetUint("userId"), c.GetString("role") == "admin", selector)
 	if err != nil {
 		utils.Forbidden(c, err.Error())
 		return
 	}
 	span := int64(5 * time.Minute)
-	before, err := services.QueryLokiLogs(c.Request.Context(), src, query, ts-span, ts-1, 1, "backward", "")
+	before, err := services.QueryLokiLogs(c.Request.Context(), src, query, ts-span, ts-1, 5, "backward", "")
 	if err != nil {
 		utils.Error(c, 502, err.Error())
 		return
 	}
-	after, err := services.QueryLokiLogs(c.Request.Context(), src, query, ts+1, ts+span, 1, "forward", "")
+	after, err := services.QueryLokiLogs(c.Request.Context(), src, query, ts+1, ts+span, 5, "forward", "")
 	if err != nil {
 		utils.Error(c, 502, err.Error())
 		return
@@ -118,6 +113,10 @@ func (ctrl *LogsController) UpdateSource(c *gin.Context) {
 	if !utils.BindAndValidate(c, &updates) {
 		return
 	}
+	if src := services.GetLogSource(uint(id)); src != nil && src.Managed && updates["isDefault"] == nil {
+		utils.BadRequest(c, "平台部署的数据源由系统管理,不可编辑")
+		return
+	}
 	if err := services.UpdateLogSource(uint(id), updates); err != nil {
 		utils.Error(c, 400, err.Error())
 		return
@@ -131,6 +130,10 @@ func (ctrl *LogsController) DeleteSource(c *gin.Context) {
 		utils.BadRequest(c, "ID 无效")
 		return
 	}
+	if src := services.GetLogSource(uint(id)); src != nil && src.Managed {
+		utils.BadRequest(c, "平台部署的数据源随部署管理,请先删除对应部署")
+		return
+	}
 	if err := services.DeleteLogSource(uint(id)); err != nil {
 		utils.Error(c, 400, err.Error())
 		return