Resolve tickets 071-074, 076: log-stream contamination, sort, ottyl_fmt column, ingest lag

- 076: gate auto-declared log-stream column/message params
  (`ParamDeclaration::log_stream_gated`) behind `is_log_stream_line` at
  extraction time, since their fixed-offset regex has no content anchor
  and previously extracted garbage from continuation lines and the
  header row itself (the regex crate doesn't support lookaround, so
  this couldn't be baked into the regex text).
- 074: end-to-end regression test confirms sorting a real `log stream`
  capture by a log-stream column (e.g. PID) now actually reorders
  results, since 076's fix removes the garbage values that were
  corrupting the sort helper index; also add a "Building sort
  index…" indicator in the timeline UI for a slow first-time sort.
- 072: attach the reserved `ottyl_fmt` pseudo-param to each
  `LogEntryDto`'s params so it can be picked as a Log Preview column
  (previously listed as pickable but always blank).
- 073: track a rolling 5s high-watermark of ingestion-to-engine-processing
  lag and surface it in the nav stats popover next to approx_bytes_total.
- 071: group the regex(...) help button back with the filter bar's other
  controls, and restructure the Filtering docs section into scannable
  per-feature subsections (also fixes stale log_type/process/pid mention).

Tickets 070 (CLI scoping) and 075 (API unresponsiveness investigation)
are left in place per their own scope — both are explicitly
conversation/investigation tasks, not implementation tickets.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A1ZJ3SrayzLzVndhVq9BmS

src/data_value.rs

@@ -41,6 +41,16 @@ pub struct ParamDeclaration {
     /// ordinary (non-auto) params.
     #[serde(default)]
     pub auto_derived: bool,
+    /// Set for a `log stream` column/message param declared by
+    /// `crate::engine::auto_declare_log_stream_params`. Those params' `message_match_regex` is a
+    /// pure fixed character-offset slice with no content anchor of its own (ticket 076) — it'll
+    /// happily "match" and extract garbage from any line at least that long, including a wrapped
+    /// multi-line dump's continuation line or the header row itself. When set, extraction (
+    /// `extract_param_raw`/`derive_log_params`) additionally requires
+    /// `crate::logfmt::is_log_stream_line(text)` before trusting the regex at all.
+    /// `#[serde(default)]` so params declared before this field existed keep extracting as before.
+    #[serde(default)]
+    pub log_stream_gated: bool,
 }
 
 /// Reads a value out of a JSON object by dot-separated field path (e.g. `"foo.bar"`), for