feat: complete Loki query, insights, settings and deployment workflows

Add the Loki query UI, access policies, ingress insights, alert and registry settings, and their backend APIs. Include the related Kubernetes deployment and collector updates required by the integrated application.

Validated with go test ./..., npm run build, and npm run lint.

backend/services/deployment_retention_test.go

@@ -0,0 +1,68 @@
+package services
+
+import (
+	"testing"
+
+	"opsxloki/repository"
+)
+
+func TestParseRetentionYAML(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		source string
+		want   int
+	}{
+		{"days", "limits_config:\n  retention_period: 90d\n", 90},
+		{"hours", "limits_config:\n  retention_period: 2160h\n", 90},
+		{"unknown field", "limits_config:\n  retention_period: 90d\n  ingestion_rate_mb: 16\n", 0},
+		{"fractional day", "limits_config:\n  retention_period: 25h\n", 0},
+		{"extra document", "limits_config:\n  retention_period: 90d\n---\nfoo: bar\n", 0},
+		{"missing field", "limits_config: {}\n", 0},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := parseRetentionYAML(tc.source)
+			if tc.want == 0 && err == nil {
+				t.Fatalf("accepted invalid YAML: %q", tc.source)
+			}
+			if tc.want != 0 && (err != nil || got != tc.want) {
+				t.Fatalf("got %d, err %v; want %d", got, err, tc.want)
+			}
+		})
+	}
+}
+
+func TestDeploymentRetentionPersistsAndRejectsInvalidValues(t *testing.T) {
+	t.Setenv("DATA_DIR", t.TempDir())
+	t.Setenv("JWT_SECRET", "test-jwt-secret-with-at-least-32-characters")
+	t.Setenv("ENCRYPTION_KEY", "test-encryption-key-with-at-least-32-characters")
+	if err := repository.InitDB(); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = repository.Shutdown() })
+
+	service := NewDeploymentService()
+	deployment, err := service.Create(&CreateDeploymentRequest{
+		Name: "loki", Mode: "k8s-yaml", Version: "3.0.0",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if deployment.RetentionDays != DefaultRetentionDays {
+		t.Fatalf("default retention = %d, want %d", deployment.RetentionDays, DefaultRetentionDays)
+	}
+	for _, invalid := range []float64{0, -1, 1.5} {
+		if err := service.Update(deployment.ID, map[string]interface{}{"retentionDays": invalid}); err == nil {
+			t.Fatalf("accepted invalid retention %v", invalid)
+		}
+	}
+	if err := service.Update(deployment.ID, map[string]interface{}{"retentionDays": float64(90)}); err != nil {
+		t.Fatal(err)
+	}
+	updated, err := service.Get(deployment.ID)
+	if err != nil || updated.RetentionDays != 90 {
+		t.Fatalf("updated retention = %v, err = %v", updated, err)
+	}
+	if err := repository.GetDB().RequestSaveSync(); err != nil {
+		t.Fatal(err)
+	}
+}