Scaffold Phase 0: agent -> Redpanda -> ingest -> ClickHouse -> api -> web

End-to-end log pipeline for Linux hosts, per /docs/architecture.md:

- proto: shared gRPC contract (agent <-> ingest), Go bindings checked in
- agent: Rust, musl-targeted, journald/file sourcing, RFC5424 parser,
  mTLS gRPC client, no required config for the common case
- ingest: Go, single binary with --mode server|consumer|all; gRPC front
  end forwards to Redpanda unchanged, consumer normalizes and
  batch-writes to ClickHouse with at-least-once delivery
- storage: ClickHouse schema + a plain SQL-file migration runner
- api: minimal SELECT-only query endpoint, plain REST (not gRPC+gateway
  yet -- see api/README.md)
- web: SvelteKit static SPA, one query page
- transport: Redpanda compose + topic provisioning
- cli: sentryctl ping stub
- hack/dev-certs: throwaway CA + cert generation for local mTLS
- root docker-compose.yml + docs/phase-0-runbook.md tie it together

Not yet run end-to-end against real Docker/ClickHouse/Redpanda -- see the
runbook's caveats section before relying on this working as-is.

web/Dockerfile

@@ -0,0 +1,24 @@
+# Build context can be just web/ (unlike agent/ingest/api, this doesn't
+# need /proto):
+#   docker build -f web/Dockerfile -t sentry-web web/
+
+FROM node:22-alpine AS builder
+WORKDIR /src
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY . .
+# VITE_API_BASE_URL is baked in at build time — this is a prerendered
+# static site, not a server. Override with --build-arg for non-default
+# deployments.
+ARG VITE_API_BASE_URL=http://localhost:8080
+ENV VITE_API_BASE_URL=${VITE_API_BASE_URL}
+RUN npm run build
+
+# Not distroless: serving a static SPA needs *some* HTTP server, and
+# nginx:alpine is the boring, well-understood choice for that job — a
+# custom static-file-serving binary would be more engineering than a
+# Phase 0 placeholder page warrants. See /web/README.md.
+FROM nginx:alpine
+COPY --from=builder /src/build /usr/share/nginx/html
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+EXPOSE 3000