Wire FilterBar query AST into logs/timeline queries (ticket 007)

Adds a filter evaluator in engine.rs that compiles a parsed FilterExpr
against the current index once per query (regex compiled once,
sequence/timestamp compared directly against IngestedLog fields,
other metric comparisons resolved to a HashSet<u64> of matching
sequences via a bucket scan) and evaluates it per log line with no
further index access. Wires this into EngineQuery::Logs/Timeline via
a new LogsParams::filter/TimelineParams::filter field, and adds
EngineResponse::Error so a malformed filter string surfaces as a
query-level error (mapped to 400 in api.rs).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XFUNZwCvz3kcod3352ZR2o

src/api.rs

@@ -122,23 +122,36 @@ async fn ask(engine: &EngineHandle, query: EngineQuery) -> Result<EngineResponse
     response.await.map_err(|_| StatusCode::SERVICE_UNAVAILABLE)
 }
 
+/// `GET /api/logs` — also accepts a `filter` query param (ticket 007): a
+/// FilterBar query string, parsed and evaluated inside the engine. A
+/// malformed filter string comes back as `EngineResponse::Error` and is
+/// surfaced here as `400 Bad Request` with `{ "error": "..." }`, matching
+/// ticket 004's `declare_param`/`declare_metric` error-mapping pattern.
 async fn get_logs(
     State(state): State<ApiState>,
     Query(params): Query<LogsParams>,
 ) -> impl IntoResponse {
     match ask(&state.engine, EngineQuery::Logs(params)).await {
         Ok(EngineResponse::Logs(entries)) => Json(entries).into_response(),
+        Ok(EngineResponse::Error(err)) => {
+            (StatusCode::BAD_REQUEST, Json(ErrorDto { error: err })).into_response()
+        }
         Ok(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
         Err(status) => status.into_response(),
     }
 }
 
+/// `GET /api/timeline` — same `filter` query param and error mapping as
+/// `get_logs` above.
 async fn get_timeline(
     State(state): State<ApiState>,
     Query(params): Query<TimelineParams>,
 ) -> impl IntoResponse {
     match ask(&state.engine, EngineQuery::Timeline(params)).await {
         Ok(EngineResponse::Timeline(buckets)) => Json(buckets).into_response(),
+        Ok(EngineResponse::Error(err)) => {
+            (StatusCode::BAD_REQUEST, Json(ErrorDto { error: err })).into_response()
+        }
         Ok(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
         Err(status) => status.into_response(),
     }