Add agent heartbeat monitoring and fix a query-language lexer bug

Agents now send an independent "still alive" record on a configurable
schedule (seconds/minutes/hours, [heartbeat] in agent.toml), separate
from real log traffic and tagged with a sentry.heartbeat attribute.
No new wire protocol -- it's an ordinary record through the same
PushBatch RPC/mTLS identity every log line already uses. Unavailability
alerting reuses the existing absence-condition alert rule type
unchanged; no new alerting code was needed. See
/docs/agent-heartbeat-monitoring.md for the design and how to build the
alert rule.

While verifying the alert rule live, found that the query language's
lexer never treated '-' as part of an identifier, so any unquoted
hyphenated filter value -- including the reference doc's own canonical
example, `host!=host-03` -- failed to parse at all. Fixed in
api/internal/querylang/lexer/lexer.go with regression tests; a leading
'-' still lexes as its own token so earliest=-1h/sort -count are
unaffected.

api/internal/querylang/lexer/lexer.go

@@ -232,7 +232,13 @@ func isIdentStart(c rune) bool {
 }
 
 // Identifiers allow dots (e.g. winevt.event_id, a real attribute key
-// shape from Phase 1) and digits after the first character.
+// shape from Phase 1), digits, and internal hyphens (e.g. host-03,
+// api-service -- real, common bare-word values with no need for
+// quoting) after the first character. A leading hyphen is deliberately
+// NOT part of isIdentStart -- Minus has to stay its own token there so
+// `earliest=-1h` and `sort -count`'s leading sign still lex correctly;
+// this only affects a hyphen once a token has already started with a
+// real identifier character.
 func isIdentPart(c rune) bool {
-	return isIdentStart(c) || isDigit(c) || c == '.' || c == '_'
+	return isIdentStart(c) || isDigit(c) || c == '.' || c == '_' || c == '-'
 }