feat(analytics): wire Logflare to ClickHouse backend

[h0lybyte]

Summary

• Bump Logflare image 1.15.3 → 1.21.0 (aligns main container with init container)
• Add idempotent K8s Job that configures ClickHouse as a Logflare backend via the API
• Add SealedSecret with ClickHouse credentials for the kilobase namespace
• Add seal-ch-credentials.sh for future credential rotation

How it works

The Job (logflare-ch-setup) runs post-deploy:

1. Waits for Logflare health endpoint (30 retries × 10s)
2. Checks if a ClickHouse backend already exists — exits cleanly if so (idempotent)
3. Creates the logflare database on ClickHouse via HTTP API
4. Creates the ClickHouse backend in Logflare via POST /api/backends
5. Assigns all existing sources to the new CH backend
6. Auto-cleans up after 24h (ttlSecondsAfterFinished)

Test plan

• Verify SealedSecret decrypts correctly in cluster
• Confirm Logflare starts on 1.21.0 with health check passing
• Watch Job logs: kubectl logs -n kilobase job/logflare-ch-setup
• Verify CH backend exists: kubectl exec into Logflare pod and check /api/backends
• Confirm OTEL tables auto-created in ClickHouse after first log ingest

Ref: #8015

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None