feat: complete Loki query, insights, settings and deployment workflows

Add the Loki query UI, access policies, ingress insights, alert and registry settings, and their backend APIs. Include the related Kubernetes deployment and collector updates required by the integrated application.

Validated with go test ./..., npm run build, and npm run lint.

backend/services/k8s_client.go

@@ -5,8 +5,12 @@ import (
 	"fmt"
 	"os"
 	"regexp"
+	"time"
 
 	"opsxloki/models"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
 )
 
 // resolveKubeconfig 取集群最终的 kubeconfig 文本（优先内存字段，其次磁盘文件）
@@ -24,6 +28,37 @@ func resolveKubeconfig(cluster *models.Cluster) (string, error) {
 	return "", fmt.Errorf("集群未配置 kubeconfig")
 }
 
+// clusterRESTConfig 使用集群保存的 kubeconfig 构造原生 API Server 客户端配置。
+func clusterRESTConfig(cluster *models.Cluster, timeout time.Duration) (*rest.Config, error) {
+	source, err := resolveKubeconfig(cluster)
+	if err != nil {
+		return nil, err
+	}
+	config, err := clientcmd.Load([]byte(source))
+	if err != nil {
+		return nil, fmt.Errorf("解析集群 kubeconfig 失败: %w", err)
+	}
+	overrides := &clientcmd.ConfigOverrides{}
+	if cluster.Context != "" {
+		overrides.CurrentContext = cluster.Context
+	}
+	result, err := clientcmd.NewNonInteractiveClientConfig(*config, config.CurrentContext, overrides, nil).ClientConfig()
+	if err != nil {
+		return nil, fmt.Errorf("构造 Kubernetes 客户端失败: %w", err)
+	}
+	result.Timeout = timeout
+	result.UserAgent = "LokiDeploy"
+	return result, nil
+}
+
+func clusterClient(cluster *models.Cluster, timeout time.Duration) (kubernetes.Interface, error) {
+	config, err := clusterRESTConfig(cluster, timeout)
+	if err != nil {
+		return nil, err
+	}
+	return kubernetes.NewForConfig(config)
+}
+
 // BuildKubeconfigFromToken 用 API Server + Token 构造最小 kubeconfig
 // 优先使用 CA 证书验证 TLS，仅在用户显式要求时跳过证书验证
 // Parameters: