Consolidate entity-free observability for 1.9

[zqr10159]

Summary

• replace the log-specific module boundary with hertzbeat-observability and move entity-free signal storage/query ownership into the warehouse layer
• expose authenticated OTLP metrics, logs, and traces ingestion over both HTTP and gRPC while keeping the existing observability query routes
• add transition and Greptime end-to-end contracts, update packaging/CI/Sureness configuration, and align the 1.9 integration documentation
• redesign the metrics, logs, and traces pages around a shared dense investigation workspace
• support Greptime-normalized OTLP resource keys in log queries and allow cold PromQL queries to complete without a false storage-unavailable result

Motivation

The 1.9 release is the transition release before the 2.0 entity model. It needs the mature three-signal ingestion and query boundary without introducing the entity layer. This change consolidates those capabilities under observability and warehouse ownership while preserving the 1.9 operator routes and resource-based filtering model.

Validation

• HTTP OTLP JSON and gRPC OTLP protobuf smoke against a real local HertzBeat backend and GreptimeDB: each transport independently wrote and queried one metric, one linked log, and one root trace
• browser verification on the production UI routes: both transports displayed the expected metric Series, canonical service-labelled log, root operation, duration, status, and Trace ID; service/environment/operation filtering was exercised
• focused backend tests: 25 warehouse tests, 22 observability tests, one Greptime cold-query timeout contract, and six startup transition contracts
• ./mvnw -pl hertzbeat-startup -am -DskipTests package: all 24 reactor modules succeeded and produced the 1.9 startup jar
• focused Angular tests: 16/16 passed
• npm run package: production build succeeded
• focused ESLint, Stylelint, Prettier, touched locale-key parity across five catalogs, changed-source CJK scans, and git diff --check passed

Upgrade impact

• the Maven module and Java package boundary changes from hertzbeat-log to hertzbeat-observability
• Greptime pipeline/table initialization is now owned by hertzbeat-warehouse
• the 1.9 transition remains resource-scoped and does not require entity identifiers
• existing public observability/OTLP route families remain available; authentication rules are updated consistently in packaged Sureness configurations

AI assistance: used for draft implementation and test iteration.
Human validation: ran the commands and real HTTP/gRPC/Greptime/browser checks listed above; all required checks passed.
Risk notes: the live local smoke used the cached GreptimeDB 1.0.1 image while repository Compose targets 1.1.3, so CI/E2E remains the final pinned-version proof. The Angular production build retains the repository's existing 3.12 MB initial-bundle budget warning. Existing unrelated full-catalog locale drift was not expanded; all keys added here are present in all five touched catalogs.

[Aias00]

Review: Consolidate entity-free observability for 1.9

Verdict: ✅ APPROVED (scoped review) — large, well-tested refactor; high-risk surfaces check out.

Scope note: this is a +3,149 / −1,488, 123-file change. I did a scoped review focused on the risk areas rather than a full line-by-line pass. The author's validation matrix (e2e against real GreptimeDB over HTTP+gRPC, 25 warehouse + 22 observability tests, transition contracts, UI tests, full reactor build) is strong.

What I verified

• Module rename is complete: no leftover hertzbeat-log references in non-test sources (only in assertions that prove the rename). Build should not have dangling imports. There's even a ContextTest asserting ThreeSignalQueryController/OtlpSignalController now resolve from hertzbeat.observability.
• Auth config is coherent with the code changes:
  • /api/otlp/**===post narrowed to /api/otlp/v1/**===post; old anonymous /api/observability/capability===get was removed from excludedResource and now requires a logged-in (guest+) role — a tightening, not a regression.
  • Removed GET rules (/api/ingestion/otlp/metrics/console, .../inventory) correspond to endpoints that were deleted in the same PR — rules and code stay in sync.
  • Deprecated /api/logs/otlp/** is kept as an alias forwarded to the canonical /api/otlp/v1/logs, with a note it's removed in 2.0.
• Dependencies: only hertzbeat-observability / hertzbeat-observability-e2e are added; no new third-party deps introduced at a glance.
• GreptimeDB integration is covered by a real GenericContainer e2e test (HTTP + gRPC write/query), and GREPTIME_QUERY_READ_TIMEOUT was bumped 5s→15s with a rationale.

Non-blocking suggestions

1. Greptime schema files: the e2e test references greptime/tables/hertzbeat_logs.sql and greptime/pipelines/hertzbeat_otlp_log_v1.yaml. Please confirm these resource files are added in this PR (the e2e would fail in CI otherwise, so CI is the backstop — just worth a manual glance).
2. Broad GET rule: /api/observability/**===get===[admin,user,guest] consolidates the former per-signal guest-read rules. Please double-check no sensitive GET endpoint under /api/observability is now unexpectedly guest-readable.

No blocking issues found in the scoped review. Good work on the transition boundary.