Add bounded read-only Prometheus and Loki investigation connectors

[hellices]

Goal

Let read-only incident investigations correlate Kubernetes state with bounded
Prometheus metrics and Loki logs without turning korvid into an observability
backend.

Current gap

korvid reads Kubernetes resources, events, pod logs, and metrics-server data.
Many production failures cannot be diagnosed from those sources alone:

• application error rates and latency precede pod failure;
• saturation exists at service or dependency level, not one pod;
• centralized logs outlive restarted/deleted pods;
• deployment symptoms need correlation with a bounded time window.

The agent currently has no typed, least-privilege connector contract for these
sources.

Scope

Create a read-only connector boundary and ship initial Prometheus and Loki
connectors:

• explicit endpoint, auth source, CA bundle, timeout, and query limits;
• bounded time range, series/line count, response bytes, and concurrency;
• no arbitrary shell or unrestricted query language generated without policy;
• credentials resolved at call time and never included in model context;
• result projection that preserves labels/timestamps needed for evidence while
  stripping or masking configured sensitive fields;
• TUI-visible query/tool log and cancellation.

Initial investigation actions should be resource-oriented, for example:

• request/error/latency signals for the selected workload or service over a
  bounded window;
• CPU/memory/restart trends for the selected resource identity;
• centralized log search scoped by configured resource label mappings.

Acceptance criteria

• The connector ABC and result types live outside the Textual layer.
• Prometheus and Loki can be configured independently and are absent cleanly
  when not configured.
• Every query has enforced timeout, time range, result-size, and concurrency
  limits before data reaches the agent.
• TLS verification cannot be disabled; corporate CA configuration follows the
  existing network trust model.
• Auth headers/tokens never appear in logs, audit records, tool results, or
  payload inspection.
• RBAC/configuration/network errors remain distinguishable and actionable.
• Tool results include source, query scope, time window, and truncation status
  so they can participate in evidence citations.
• Unit tests use deterministic fake servers; live integration tests are opt-in
  and never depend on a public service.

Out of scope

• Hosting Prometheus, Loki, or an OpenTelemetry collector.
• Writing alerts, dashboards, or recording rules.
• Unbounded free-form queries.
• Cloud-provider, tracing, and deployment-system connectors in the first PR.