feat: Phase 2 - incidents, logs, monitor expansion, query compiler

[sounak98]

Summary

• Incidents (API v3): full CRUD with 8 subcommands (list, get, create, ack, resolve, escalate, delete, timeline) and colored status output
• Monitor expansion: update with field-level edits, availability (SLA endpoint), response-times with nested region breakdown
• Logs: sources via Telemetry API, sql raw ClickHouse queries, query with simple filter compiler, tail polling-based live tail
• Query compiler: translates level:error AND status:>=500 to ClickHouse SQL with duration parsing, wildcards, numeric comparisons, AND/OR
• Infrastructure: v3 HTTP helpers, shared parse_one/check_status, SqlClient with Basic auth, optional telemetry client in AppContext

New commands

bs incidents list/get/create/ack/resolve/escalate/delete/timeline
bs monitors update <id> --name/--url/--frequency/...
bs monitors availability <id> --from/--to
bs monitors response-times <id> --from/--to
bs logs sources
bs logs source <id>
bs logs sql "SELECT ..."
bs logs query "level:error" --source <table> --since 1h
bs logs tail --source <table> --since 5m

New files (8)

• src/types/incident.rs, src/types/source.rs
• src/adapters/http/incidents.rs, src/adapters/http/sql.rs, src/adapters/http/telemetry.rs
• src/commands/incidents.rs, src/commands/logs.rs
• src/query/mod.rs

Test plan

• 9 new query compiler unit tests pass
• 4 existing monitors integration tests pass
• 8 existing output unit tests pass
• make fmt && make check clean (no clippy warnings)
• Manual testing of incidents commands against live API
• Manual testing of logs commands with SQL credentials