feat: add expression-based log filtering and sampling

[peterborodatyy]

Summary

• Add configurable filter/sampling layer using expr-lang expressions, evaluated post-parse against structured log fields
• Support drop (remove matches) and keep (retain only matches) actions with optional sample_rate (0-1) per rule
• Auto-coerce numeric NGINX fields (status, request_time, etc.) so users write status >= 500 not int(status) >= 500
• Rules configurable via YAML (settings.filters) or env var (FILTER_RULES)
• Add nginx_clickhouse_lines_filtered_total Prometheus metric
• Validate filter expressions at startup and via -check flag

Example

settings:
  filters:
    - expr: 'request contains "/health"'
      action: drop
    - expr: 'status >= 200 && status < 300'
      action: drop
      sample_rate: 0.9   # drop 90% of 2xx, keep 10%
    - expr: 'request_time == 0'
      action: drop
    - expr: 'status >= 500'
      action: keep

Motivation

Users frequently need to reduce log volume before it reaches ClickHouse — dropping health checks, sampling high-volume 2xx traffic, filtering cached responses with zero latency. Previously this required an extra hop through Vector/Fluent Bit. This feature handles it natively with a small expression DSL.

Changes

• New package: filter/ — expr compilation, drop/keep/sampling logic, numeric field coercion
• Modified: config/config.go — FilterRule struct, FILTER_RULES env var parsing
• Modified: main.go — filter chain init, wired into flush(), flushLoop(), replay, --check
• Modified: config-sample.yml — documented filter examples
• Modified: README.md — new Filtering & Sampling section, updated metrics table, env vars, --check output
• Modified: CLAUDE.md — architecture, deps, test counts

Test plan

• 21 filter tests: drop, keep, sampling (deterministic + statistical), missing fields, non-numeric fallback, empty entries, multiple rules, rule ordering, regex, contains, unknown fields, invalid
  expr/action/sample_rate
• 5 config tests: YAML parsing, env var parsing, edge cases (empty, trailing ;, no colon), env replaces YAML
• Full suite: 145 tests across 8 packages, all pass with -race
• gofmt, go vet clean