feat(syslog): a source's lines to read and search, on its page, its host's and its SNMP device's, and over MCP (#6000)

- /plugins/syslog/sources/<id>: the lines newest first, loading as you
  scroll, filtered by severity and worse, app, text and time, with day
  dividers and times to the second in the reader's zone.
- The Syslog page links each source and shows its lines in the last hour.
- A Syslog panel on a host's page and an SNMP device's: the newest lines of
  the sources bound to it or at its address.
- MCP: list_syslog_sources and search_syslog (source, host, text, severity
  and worse, app, range, paging by next_before).
- Shared: escape_like moves to steward/core/like.py and cut_middle to the
  MCP shaping module, replacing four inline copies; |when takes seconds=.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/docker/service.py

@@ -12,6 +12,7 @@ from datetime import datetime, timedelta, timezone
 from sqlalchemy import func, select
 
 from steward.core import metric_series
+from steward.core.like import escape_like
 from steward.models.hosts import Host
 from steward.models.metrics import PluginMetric
 
@@ -274,11 +275,6 @@ async def host_map(db, host_ids: set[str]) -> dict[str, Host]:
     }
 
 
-def escape_like(text: str) -> str:
-    """Make `text` match literally inside a LIKE/ILIKE pattern (escape char \\)."""
-    return text.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")
-
-
 async def list_containers(db, host_id: str | None = None) -> list[DockerContainer]:
     """Containers, running first then by name; one host's when host_id is given."""
     stmt = select(DockerContainer)