feat(log): add log viewing provider

[retr0h]

Summary

• Add read-only log viewing provider that queries systemd journal entries via journalctl --output=json
• Two endpoints: GET /node/{hostname}/log (query all) and GET /node/{hostname}/log/unit/{name} (query by unit)
• Optional query params: lines (default 100), since (time filter), priority (0-7 or name)
• Full cross-layer implementation: provider, agent processor, API handlers, SDK service, CLI commands
• log:read permission added to all built-in roles (admin, write, read)
• Container-aware: returns ErrUnsupported in containers (journalctl requires systemd)
• Broadcast support for all operations

Test plan

• Unit tests pass (just go::unit)
• Lint clean (just go::vet)
• Integration test covers query and unit endpoints
• Verify on Debian host: osapi client node log query --target _any
• Verify on Debian host: osapi client node log unit --target _any --name sshd.service
• Verify broadcast: osapi client node log query --target _all
• Verify --json output for both commands
• Verify skipped status on Darwin/container

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@            Coverage Diff             @@
##             main     #335      +/-   ##
==========================================
+ Coverage   99.82%   99.89%   +0.07%     
==========================================
  Files         383      396      +13     
  Lines       17648    18200     +552     
==========================================
+ Hits        17617    18181     +564     
+ Misses         19       11       -8     
+ Partials       12        8       -4     

Files with missing lines	Coverage Δ
internal/agent/processor.go	100.00% <100.00%> (ø)
internal/agent/processor_log.go	100.00% <100.00%> (ø)
internal/authtoken/permissions.go	100.00% <ø> (ø)
internal/controller/api/node/log/handler.go	100.00% <100.00%> (ø)
internal/controller/api/node/log/log.go	100.00% <100.00%> (ø)
internal/controller/api/node/log/log_query_get.go	100.00% <100.00%> (ø)
internal/controller/api/node/log/log_source_get.go	100.00% <100.00%> (ø)
internal/controller/api/node/log/log_unit_get.go	100.00% <100.00%> (ø)
internal/controller/api/node/log/validate.go	100.00% <100.00%> (ø)
internal/provider/node/log/darwin.go	100.00% <100.00%> (ø)
... and 6 more

... and 2 files with indirect coverage changes

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1f2d33b...3a275cd. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.