feat: complete Loki query, insights, settings and deployment workflows

Add the Loki query UI, access policies, ingress insights, alert and registry settings, and their backend APIs. Include the related Kubernetes deployment and collector updates required by the integrated application.

Validated with go test ./..., npm run build, and npm run lint.

backend/services/collector_sidecar_mount_test.go

@@ -0,0 +1,64 @@
+package services
+
+import (
+	"strings"
+	"testing"
+
+	"gopkg.in/yaml.v3"
+)
+
+func TestSidecarReusesApplicationLogVolume(t *testing.T) {
+	deployment := []byte(`{"spec":{"template":{"spec":{"containers":[{"name":"st-bos-forex-order","volumeMounts":[{"name":"app-logs","mountPath":"/bitcloud/app/st-bos-forex-order/logs"}]},{"name":"fluent-bit"}],"volumes":[{"name":"app-logs"}]}}}}`)
+	mount, err := resolveSidecarLogMount(deployment, "st-bos-forex-order", "/bitcloud/app/st-bos-forex-order/logs/*.log", 42)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if mount.volumeName != "app-logs" || mount.mountPath != "/bitcloud/app/st-bos-forex-order/logs" || mount.createVolume || mount.mountApplication {
+		t.Fatalf("should reuse the existing application mount: %+v", mount)
+	}
+	patch := SidecarPatchYAML("fluent-bit-config-42", mount)
+	var parsed map[string]any
+	if err := yaml.Unmarshal([]byte(patch), &parsed); err != nil {
+		t.Fatalf("invalid strategic merge patch: %v", err)
+	}
+	if !strings.Contains(patch, "name: fluent-bit-config-42") || !strings.Contains(patch, "name: app-logs") {
+		t.Fatalf("patch does not reference the existing log volume and dedicated config: %s", patch)
+	}
+}
+
+func TestSidecarCreatesSharedVolumeOnlyForDedicatedDirectory(t *testing.T) {
+	deployment := []byte(`{"spec":{"template":{"spec":{"containers":[{"name":"jar-monitor"}]}}}}`)
+	mount, err := resolveSidecarLogMount(deployment, "jar-monitor", "/var/log/app/*.log", 7)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !mount.createVolume || !mount.mountApplication || mount.mountPath != "/var/log/app" || mount.volumeName != "loki-collector-logs-7" {
+		t.Fatalf("expected a shared volume for both containers: %+v", mount)
+	}
+	patch := SidecarPatchYAML("fluent-bit-config-7", mount)
+	var parsed map[string]any
+	if err := yaml.Unmarshal([]byte(patch), &parsed); err != nil {
+		t.Fatalf("invalid strategic merge patch: %v", err)
+	}
+	if !strings.Contains(patch, "name: jar-monitor\n        volumeMounts:") {
+		t.Fatalf("application container is missing its log mount: %s", patch)
+	}
+	if _, err := resolveSidecarLogMount(deployment, "jar-monitor", "/tmp/test.log", 7); err == nil {
+		t.Fatal("/tmp must not be covered by a new emptyDir")
+	}
+}
+
+func TestSidecarRemovalKeepsApplicationOwnedVolume(t *testing.T) {
+	deployment := []byte(`{"spec":{"template":{"spec":{"containers":[{"name":"app","volumeMounts":[{"name":"app-logs","mountPath":"/business/logs"},{"name":"loki-collector-logs-7","mountPath":"/var/log/app"}]},{"name":"fluent-bit"}],"volumes":[{"name":"app-logs"},{"name":"loki-collector-logs-7"},{"name":"fluent-bit-config"}]}}}}`)
+	patch, err := sidecarRemovePatchYAML(deployment, 7)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var parsed map[string]any
+	if err := yaml.Unmarshal([]byte(patch), &parsed); err != nil {
+		t.Fatalf("invalid removal patch: %v", err)
+	}
+	if strings.Contains(patch, "name: app-logs") || !strings.Contains(patch, "name: loki-collector-logs-7") || !strings.Contains(patch, `mountPath: "/var/log/app"`) {
+		t.Fatalf("removal must only clean collector-owned mounts: %s", patch)
+	}
+}