Wire FilterBar query AST into logs/timeline queries (ticket 007)

Adds a filter evaluator in engine.rs that compiles a parsed FilterExpr
against the current index once per query (regex compiled once,
sequence/timestamp compared directly against IngestedLog fields,
other metric comparisons resolved to a HashSet<u64> of matching
sequences via a bucket scan) and evaluates it per log line with no
further index access. Wires this into EngineQuery::Logs/Timeline via
a new LogsParams::filter/TimelineParams::filter field, and adds
EngineResponse::Error so a malformed filter string surfaces as a
query-level error (mapped to 400 in api.rs).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XFUNZwCvz3kcod3352ZR2o

src/dto.rs

@@ -47,6 +47,10 @@ pub struct LogsParams {
     pub start_ms: Option<i64>,
     pub end_ms: Option<i64>,
     pub limit: Option<usize>,
+    /// Raw FilterBar query string (ticket 007), e.g. `regex("error") and
+    /// sequence<5`. Parsed with `filter_parser::parse` and evaluated in the
+    /// engine; a malformed string surfaces as `EngineResponse::Error`.
+    pub filter: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -54,6 +58,9 @@ pub struct TimelineParams {
     pub start_ms: Option<i64>,
     pub end_ms: Option<i64>,
     pub bucket_ms: Option<i64>,
+    /// Same FilterBar query string as `LogsParams::filter`: only logs
+    /// matching it are counted into timeline buckets.
+    pub filter: Option<String>,
 }
 
 /// One entry from a metric's derived bucket timeseries: the label combination