TUI: Enhanced log query and aggregation

[coreyt]

Problem

The Logs screen reads JSONL files and supports model/user/status/type filtering, export, and an analysis runner. But operators still can't:

• Query by time range — currently reads the last N days of files; no way to say "show me 2pm-3pm yesterday"
• Full-text search on message content or error text
• Aggregate — "how many requests from client X were blocked?" requires manual counting

The export feature (added in the recent refactor) helps with offline analysis but doesn't solve the interactive query gap.

Scope

Time range filter

• Add start/end datetime inputs (or a time-range select: "last 1h", "last 6h", "today", "custom")
• Filter records by timestamp after loading

Full-text search

• Add a search input that matches against messages, error, mcp_tool_name, and other text fields
• Highlight matching terms in the detail pane

Aggregation tab

• Add a tab alongside Optimizations/Cache/Trends that shows grouped counts:
  • Requests by model
  • Errors by type
  • Blocked requests by client
  • MCP tool call distribution
• This can be computed client-side from the filtered record set — no backend changes needed

Design consideration

The Logs screen is already widget-dense. Consider whether aggregation belongs in its own tab (within the existing TabbedContent) or as a summary bar above the table. The time range filter should replace the current "Days" integer input with something more expressive.