v2.4.1 — fixed against a real 8.18.7 appliance (VMware-AIops#45)

First run of every tool on real hardware (Aria Operations for Logs 8.18.7-25423541, ingesting ESXi and vCenter
syslog). Three of the seven tools failed on every call, because the tests mocked response shapes the appliance
never sends. The regression tests now replay responses captured from that appliance
(tests/fixtures/li_8_18_7.json).

• get_log_alert_history returns real records. Captured from a temporary alert that fired on 8.18.7 (then
  deleted): each record is {triggerTimestamp, acknowledged, messages, ...}. The code read keys a record does not
  have, so every row would have been {timestamp_ms: null, info: ""}. Rows are now {timestamp_ms, acknowledged, message_count, messages} (at most 3 events per record). History is paged by the appliance (up to 50), so a full page now
  says truncated: true with total: null instead of claiming to be the whole history.
• list_log_fields, list_log_alerts, get_log_alert_history work. 8.18.7 answers these with a bare JSON
  array; the code read it as an object and every call failed with AttributeError: operation failed. Field items are
  now {name, internal_name, type}. For a content-pack field name is the qualified
  <pack namespace>:<display name>, the only form a query accepts (verified on 8.18.7). These fields also carry
  display_name and content_pack. This costs one extra read of the content-pack list.
• aggregate_logs bins have timestamps. Bins carry minTimestamp/maxTimestamp; every timestamp_ms was
  null, so spikes could not be placed in time. Bins are now {timestamp_ms, end_ms, value}, oldest first.
• aggregate_logs takes field (CLI --field). UCOUNT, AVG, MIN, MAX, SUM, STDDEV and VARIANCE need one and
  answered HTTP 400 without it; COUNT and SAMPLE refuse one. Both are now checked before the call. An unknown field
  returns an empty series with a note. A SAMPLE bin's value (a raw event) is now sanitized.
• search_logs fills hostname, appname and procid. On 8.18.7 these carry a position in the event text
  instead of a value, and always came back as "".
• search_logs returns at most 200 events and says when it lowers limit. The cap was 20000 and silent; 20000
  events was a 16 MB result that took 31 s and was stored whole in the audit database.
• Windows longer than ~24.8 days work. The appliance reads LAST as a 32-bit millisecond count and answered
  HTTP 400; such a window is now sent as an absolute start time.
• begin_ms after end_ms, and a value that looks like epoch seconds, are refused with the fix.
• An alert id containing /, ?, spaces or .. is refused (../version used to reach /version). An unknown id
  (HTTP 404, or 500 for a non-UUID) now says "copy an exact id", not "retry".
• Errors say "run doctor" only when doctor can help (config, credentials, reachability). An unexpected error says it
  is not an input problem.
• doctor now reads GET /fields through the same code the tools use, so a broken query API no longer passes.
• Roles: a target-limited role can use this skill. The role resolver read a name field that this skill's
  target config does not have, so it raised on every call. Every call by a token whose role lists targets was
  refused as "cannot be resolved", and the audit row could not name the default target.
• A refused argument now logs one warning line; real failures keep their traceback.
• Spikes are measured against quiet, not only against bursts. The appliance omits bins with no events. For
  COUNT and UCOUNT those bins are now added back as 0 (filled_empty_bins: true), so a burst after a quiet stretch
  is reported as a spike.
• A content-pack field whose pack is missing from the pack list is marked unresolved with a note. Fields the
  appliance lists twice are listed once. A non-JSON answer (e.g. a proxy's login page) is reported as the
  appliance or proxy answering wrongly, not as an argument error.
• An empty text search says why. text matches whole words: on 8.18.7 agt-w2 returned 0 events
  (complete: true) while agt-w2* returned 50+. When a text search without * matches nothing, search_logs and
  aggregate_logs now add a note suggesting the wildcard, instead of an empty result that reads as "no such logs".
• Docs: search_logs has no field-filter parameter (the docs said it had); text matches whole words, not
  substrings, and * is a wildcard; corrected token estimates.