Add json[field] filter accessor for JSON log lines (ticket 016)

Extends the FilterBar query language with a json[field] <op> value
comparison, parsed by filter_parser.pest/rs alongside metric[param],
and evaluated in engine.rs by parsing each line as JSON at query time
(lines that aren't valid JSON, or lack the field, simply don't match).
Also wired into alerts.rs since json[field], like regex/sequence/
timestamp, only needs the line's own text.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XFUNZwCvz3kcod3352ZR2o

src/alerts.rs

@@ -1,6 +1,6 @@
 //! Alert rules: definitions, trigger evaluation, and ntfy delivery.
 //!
-//! Alert queries are restricted to regex/sequence/timestamp — a metric[param] comparison would require a full bucket rescan per line, breaking the proportional-cost guarantee.
+//! Alert queries are restricted to regex/sequence/timestamp/json[field] — a metric[param] comparison would require a full bucket rescan per line, breaking the proportional-cost guarantee. json[field] is fine here since, like regex/sequence/timestamp, it only inspects the line's own text/fields, no index lookup.
 
 use std::collections::hash_map::DefaultHasher;
 use std::collections::{HashMap, HashSet, VecDeque};
@@ -13,7 +13,7 @@ use std::time::{SystemTime, UNIX_EPOCH};
 use regex::Regex;
 use serde::{Deserialize, Serialize};
 
-use crate::engine::apply_compare_op;
+use crate::engine::{apply_compare_op, eval_json_comparison};
 use crate::filter_datetime;
 use crate::filter_parser::{self, CompareOp, FilterExpr, FilterValue};
 use crate::settings::Settings;
@@ -155,7 +155,7 @@ fn prune_window(timestamps: &mut VecDeque<i64>, now_ms: i64, window_ms: i64) {
     }
 }
 
-/// Evaluates a FilterBar query against a single line's own fields only (metric[param] comparisons aren't supported — see module doc).
+/// Evaluates a FilterBar query against a single line's own fields only (metric[param] comparisons aren't supported — see module doc; json[field] is supported since it's also line-local).
 fn eval_alert_query(query: &str, sequence: u64, timestamp: Timestamp, text: &str) -> Result<bool, String> {
     let expr = filter_parser::parse(query).map_err(|err| err.to_string())?;
     eval_alert_expr(&expr, sequence, timestamp, text)
@@ -189,6 +189,9 @@ fn eval_alert_expr(expr: &FilterExpr, sequence: u64, timestamp: Timestamp, text:
             "alert queries only support regex()/sequence/timestamp (not metric comparisons like \
              '{metric}[param]'): metric-based alert conditions aren't supported yet"
         )),
+        FilterExpr::JsonComparison { field, op, value } => {
+            Ok(eval_json_comparison(text, field, *op, value))
+        }
         FilterExpr::And(lhs, rhs) => {
             Ok(eval_alert_expr(lhs, sequence, timestamp, text)? && eval_alert_expr(rhs, sequence, timestamp, text)?)
         }