feat(loki): add strict fail-closed query guardrails

[rshn20]

What this changes

Adds an opt-in strict mode to the existing Loki query guardrail for autonomous MCP clients.

Grafana Cloud does not apply maxQueryBytesRead to filterless log queries. Strict mode closes that gap by:

• requiring a non-empty line filter for native Loki queries
• restricting queries to an explicit datasource allowlist
• rejecting queries that cannot be parsed or cost-estimated
• enforcing byte and time-range limits before execution
• preventing access through unguarded API, rendering, and panel-query paths
• disabling Loki query paths whose byte-limit behavior cannot be verified

Strict mode remains read-only by default. update_dashboard can be selectively restored with --enable-write-tools=update_dashboard without enabling datasource writes or other write tools.

Existing off, shadow, and enforce behavior is unchanged.

How you tested it

• go test -tags=unit ./...
• go vet ./...
• JSON schema linter
• OpenAPI context linter
• gofmt and git diff --check
• Tests cover filterless queries, datasource allowlisting, byte and range limits, incomplete estimates, unsafe startup configurations, query rewriting, and the isolated dashboard-write override

Checklist

• make lint and make test-unit pass locally
• Commits are signed
• CLA signed
• README tool table updated, with RBAC permissions and scopes, if this adds a tool
• Any write operation respects --disable-write
• Any datasource query execution respects --disable-query and --disable-write where applicable

[cla-assistant]

All committers have signed the CLA.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit eeed5f5. Configure here.}