Add json[field] filter accessor for JSON log lines (ticket 016)

Extends the FilterBar query language with a json[field] <op> value
comparison, parsed by filter_parser.pest/rs alongside metric[param],
and evaluated in engine.rs by parsing each line as JSON at query time
(lines that aren't valid JSON, or lack the field, simply don't match).
Also wired into alerts.rs since json[field], like regex/sequence/
timestamp, only needs the line's own text.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XFUNZwCvz3kcod3352ZR2o

src/filter_parser.pest

@@ -3,6 +3,7 @@
 // Supports:
 //   - regex("...")                      raw-text regex search over log lines
 //   - metric_name[param] <op> value     metric comparisons
+//   - json[field] <op> value            JSON field comparisons (line parsed as JSON)
 //   - sequence <op> value               reserved metric name (no [param])
 //   - timestamp <op> value              reserved metric name (no [param])
 //   - `and` / `or` boolean combinators, with `and` binding tighter than `or`
@@ -31,7 +32,12 @@ string_literal = ${ "\"" ~ inner_str ~ "\"" }
 inner_str = @{ (escaped_char | !("\"" | "\\") ~ ANY)* }
 escaped_char = @{ "\\" ~ ANY }
 
-comparison = { metric ~ ("[" ~ param ~ "]")? ~ op ~ value }
+comparison = _{ json_comparison | metric_comparison }
+
+// `json[field] <op> value` must be tried before `metric_comparison` since "json" is
+// otherwise a syntactically valid (if never declared) metric name.
+json_comparison = { "json" ~ "[" ~ param ~ "]" ~ op ~ value }
+metric_comparison = { metric ~ ("[" ~ param ~ "]")? ~ op ~ value }
 
 metric = @{ ident }
 param = @{ ident }