feat(explore): Trace inspect + Log inspect — cross-layer trace/log query tools (#72)

## Why

The per-layer Traces / Logs / Browser-errors / Pod-logs tabs answer "what's happening in *this* service?" — but operators often need to query **across layers**, by trace-id / keyword / category / pod, with no layer in hand. This adds two cross-layer **inspect** power-tools modeled on Metrics inspect: name a service (pick it, type it, or leave it blank), set conditions, get one result. As an inspect surface it deliberately exposes every layer / service / flag rather than pinning defaults.

## What

### Trace inspect (`/operate/trace-inspect`)

Cross-layer trace query with a **Native ↔ Zipkin** source toggle. Optional entity — **Pick** (layer→service→instance→endpoint), **Type** (service name + real flag, which the BFF base64-encodes into the OAP id), or **blank** (all services). Native conditions (status / order / duration / tags / trace-id / time) plus the duration-distribution scatter — drag to brush-filter the list, click a dot to open the trace (a brush drag no longer also opens a detail). Zipkin gets its own service / remote-service / span pickers + annotation query. Result and detail reuse the **same shared widgets** as the per-layer Traces tab.

### Log inspect (`/operate/log-inspect`)

Cross-layer log query; row-click opens a shared full-payload popout. Three sources:

- **Raw** — OAP `queryLogs` (Tags / Trace ID / Time / Limit); Tags is a custom on-theme key/value autocomplete.

- **Browser** — the BROWSER layer's JS errors, filtered by **Category, Version and Page** (`serviceVersionId` / `pagePathId`) plus time; **upload and manage source maps** inline, and the row popout resolves the minified stack against them. Entity is Pick / Type / blank with no pinned layer.

- **Kubernetes Pod logs** — on-demand container tail. **Pick or Type** a service (Type is layer-less — the typed name encodes to a service id, and a Real flag is exposed), then the pod + container **auto-select**, and it **live auto-tails** (Interval + Pause/Start + Refresh) with **Include / Exclude** raw-regex filters. Live and never persisted → no cold-stage; surfaces OAP's `errorReason` (e.g. a terminated pod). A tip notes that each pod is the service instance, surfaced as its live Kubernetes pod, so it must be currently running.

### Shared + cross-cutting

- New shared widgets (`render/widgets/`): `TraceListPanel`, `TraceDetailCard`, `TraceDistribution`, `ZipkinTraceDetailCard`, `LogStreamPanel`, `LogDetailPopout`, `BrowserErrorPopout` — extracted from the per-layer views and reused by **both** the inspect tools and those tabs (no behavior/look change to the per-layer Traces / Logs / Browser tabs).

- New `TagInput` primitive — a custom dark, anchored autocomplete dropdown (tag key suggestions before `=`, per-key values after) replacing the browser-native `<datalist>`, in the inspect Tags fields and the per-layer Traces / Logs tag inputs.

- BFF: one `POST /api/explore/query` dispatches by kind + source; byte-exact entity-id encoding in `util/entityId.ts` (verified against OAP `IDManager`); `fetchNativeList` / `fetchLogs` / `fetchBrowserErrors` extracted from the per-layer routes; k8s reuses the existing pod-log routes. Cold-stage is honored for native trace / raw logs / browser errors and correctly a no-op for k8s pod logs and Zipkin.

- **RBAC**: both tools gate on **`inspect:read`** — the same verb as Metrics inspect, so one grant covers all three inspectors (the prior dedicated `explore:read` verb was removed). Note: this also grants the **viewer** role Metrics inspect.

- MAL/DSL rule cards now show the full rule name (wrapping to a second line) with the status pills moved to the bottom-right corner.

- i18n: every new string in `en.json` first + all 7 non-English locales.