feat(syslog): a source's lines to read and search, on its page, its host's and its SNMP device's, and over MCP (#6000)

- /plugins/syslog/sources/<id>: the lines newest first, loading as you
  scroll, filtered by severity and worse, app, text and time, with day
  dividers and times to the second in the reader's zone.
- The Syslog page links each source and shows its lines in the last hour.
- A Syslog panel on a host's page and an SNMP device's: the newest lines of
  the sources bound to it or at its address.
- MCP: list_syslog_sources and search_syslog (source, host, text, severity
  and worse, app, range, paging by next_before).
- Shared: escape_like moves to steward/core/like.py and cut_middle to the
  MCP shaping module, replacing four inline copies; |when takes seconds=.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/mcp/tools/audit.py

@@ -5,6 +5,7 @@ import json
 
 from sqlalchemy import or_, select
 
+from steward.core.like import escape_like
 from steward.models.audit import AuditEvent
 from steward.models.users import UserRole
 
@@ -32,8 +33,7 @@ async def list_audit_events(action: str = "", user: str = "", entity_type: str =
     stmt = (select(AuditEvent).where(AuditEvent.timestamp >= since)
             .order_by(AuditEvent.timestamp.desc()).limit(limit + 1))
     if action:
-        esc = action.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")
-        stmt = stmt.where(AuditEvent.action.like(esc + "%", escape="\\"))
+        stmt = stmt.where(AuditEvent.action.like(escape_like(action) + "%", escape="\\"))
     if user:
         stmt = stmt.where(or_(AuditEvent.username == user,
                               AuditEvent.username == mcp_username(user)))