feat(query): time-based queries with @ts virtual field and index integrity fixes

[raaymax]

Summary

• Time-based field filtering: filter values like now-5m, now-1h30m and absolute timestamps are resolved at query time for comparison operators on any field
• @ts virtual field: filters by index ingestion timestamp (when lazytail captured the line) rather than a log payload field. Works as a bitmap at the scan level — no changes to the Filter trait
• Capture index offset fix: correct index offsets when appending to existing log files (the root cause of garbled lines and UTF-8 errors in TUI)
• Corrupt index detection and warnings: validate indexes on open, show popup + persistent status bar warning for broken indexes

Usage

# Time-based field filtering (TUI query mode)
json | timestamp >= "now-5m"
logfmt | ts >= "2024-01-15T10:00:00Z"

# @ts virtual field — filter by ingestion time
@ts >= "now-5m"
@ts >= "now-1h" | @ts < "now-5m" | json | level == "error"
json | @ts >= "now-30m" | level == "error"

# MCP structured query
{"field": "@ts", "op": "gte", "value": "now-5m"}

Changes

Time-based queries

• time.rs: relative time resolution (now-5m), timestamp parser (RFC 3339, ISO 8601, epoch s/ms), TsBounds struct for @ts bitmap evaluation
• filter.rs: pre-resolve time values at QueryFilter construction for comparison operators
• parser.rs: accept @ prefix in field names, route @ts to ts_filters, optional parser prefix (@ts >= "now-5m" works without json |)
• ast.rs: ts_filters field on FilterQuery, partition_ts_filters() for MCP JSON path
• search_engine.rs: build @ts bitmap from index timestamps, AND with flags bitmap
• filter_orchestrator.rs: validate @ts requires indexed file source
• filter_controller.rs: validate @ts values during live filter preview

Index integrity

• capture.rs: set current_offset to existing file size when creating fresh index on appended file
• builder.rs: set_current_offset() method on LineIndexer
• validate.rs: accept non-zero first offset (for appended captures), reject when byte boundary check fails
• reader.rs: IndexReader::open now calls validate_index, cross-check content lengths in try_refresh_columnar_offsets
• file_reader.rs: content-length cross-check at sampled offsets to detect broken indexes

TUI warnings

• Warning popup on tab open/switch when index is corrupt
• Persistent status bar warning when viewing a source with corrupt index
• Stats panel warning in error color

Testing

• 731 tests pass (13 new), clippy clean
• New tests for: @ts parsing, TsBounds matching, partition from JSON, standalone @ts queries, broken index detection on refresh, correct appended index acceptance, validate_index offset rejection/acceptance