feat: add fleet camera selectors and query API

[matteius]

Summary

• add a reusable, versioned camera selector AST for fleet authorization, event routing, storage policy, bulk jobs, and saved views
• add credential-safe server-side fleet camera query and selector preview APIs
• compose location subtrees, normalized tag any/all/none, camera identity, enabled and recording state, ONVIF capabilities, vendor/model seams, and runtime health
• return authorized totals, stable sorted pages, active facets, and optional per-camera match explanations

API

• POST /api/fleet/cameras/query
• POST /api/fleet/selectors/preview

Selector v1 supports bounded and, or, and not composition. Requests are limited to 8 levels, 64 nodes, 64 values per node, and 200 cameras per page. Preview pages are capped at 50.

Security and compatibility

• existing allowed_tags RBAC is applied before results, totals, or facets are calculated
• returned addresses contain only scheme and network authority; source credentials, paths, query strings, and fragments are omitted
• selector inputs are typed data evaluated by bounded code and cannot inject SQL
• current stream and organization APIs remain unchanged

Scale and validation

• a 1,000-camera fixture reports all 1,000 matches while returning only the requested 25-camera page
• 12 focused selector/query tests cover Boolean composition, predicate validation, depth/node bounds, hierarchy and normalized tags, credential redaction, facets, stable pagination, preview explanations, and RBAC count isolation
• release regression: 9/9 suites passed across streams, locations, tags, selectors, fleet API, auth, and system API
• ASan/UBSan: 2/2 selector and fleet API suites passed

Stack

• depends on feat: normalize camera tags for fleet organization #499 (normalized camera tags)
• which depends on feat: add camera location hierarchy #498 (camera location hierarchy)
• which depends on feat: add stable camera UUIDs #497 (stable camera UUIDs)
• roadmap: docs: define fleet control plane PRD roadmap #496