feat(docs): interactive query playground + live landing SDK demo

CHANGELOG.md

@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- **Interactive query playground + live landing-page SDK demo** (`docs/src/lib/playground.ts` (new), `docs/src/components/QueryPlayground.astro` (new), `docs/src/components/HomeQueryDemo.astro` (new), `docs/src/content/docs/playground.mdx` (new), `docs/src/content/docs/index.mdx`, `docs/src/config/sidebar.ts`, `docs/src/styles/global.css`): closes #286. A new **`/playground`** page lets visitors build a structured query against the live `gh_events` table on the public read-only demo at `stats.wavehouse.dev` — column picker, AND-combined filter rows, aggregations + group-by, order/limit, and time range — then **Run** it (or **Watch live** over SSE) entirely in the browser via [`@wavehouse/sdk`](/sdk). As you build, the equivalent SDK chain and the raw `/v1/query` JSON AST update live (copy-pasteable), and the query serializes to a shareable `?q=` URL. The landing-page "Query it like a database. Subscribe to it like a socket." section is now interactive too: the **Query** tab runs a tweakable query and renders rows inline (with an "Open the full playground →" deep link), and the **Live updates** tab opens an SSE tail you can watch events land in; the **Ingest** tab stays illustrative since the demo is read-only. No code is `eval`'d — the structured builder drives a typed `QuerySpec`, so the on-page code box is *generated*, never executed text. A shared runtime (`src/lib/playground.ts`) owns the curated public schema, the SDK client, the spec→builder/code/AST bridge, the results-table renderer, and `?q=` (de)serialization, so the landing demo and the full page never drift. Runs are bounded by a 12s client-side abort on the shared public endpoint, degrade to a stable skeleton without JS, and tear down cleanly across Astro view transitions.
 - **"Behind a reverse proxy" deployment guide** (`docs/src/content/docs/reverse-proxy.mdx` (new), `docs/src/config/sidebar.ts`, `docs/src/content/docs/deployment.md`, `docs/src/content/docs/configuration.mdx`, `docs/src/content/docs/api.md`, `internal/api/stream.go`, `internal/api/stream_test.go`): closes #241. A new Operations page for the common "WaveHouse behind nginx / Caddy / Cloudflare Tunnel" setup, since several behaviors only matter behind a proxy and weren't documented together. Covers: TLS termination (WaveHouse serves plain HTTP and manages no certs); the request-body size limits and the division of responsibility (WaveHouse ships fixed in-code memory-safety backstops — 1 MiB control / 16 MiB ingest — while the proxy is the tunable *outer* limit, so a missing/loose proxy limit can't OOM the server); Server-Sent Events buffering + idle-timeout tuning (WaveHouse sends one `: connected` comment then **no periodic heartbeat** yet, [#226](https://github.com/Wave-RF/WaveHouse/issues/226), so quiet streams rely on the proxy not closing idle connections and on `EventSource` auto-reconnect); the `?token=` / `since` / `Last-Event-ID` forwarding streams need; `X-Forwarded-For` trust (don't expose `:8080` directly — it's honored, so a direct client could spoof it); and which health paths to expose (`/livez`/`/readyz` internal-optional, `/v1/health` must stay public). Ships full example nginx, Caddy, and Cloudflare-Tunnel configs, and is cross-linked from Deployment, Configuration, and the API reference. One small code change lands with it: the SSE endpoint (`GET /v1/stream`) now sets `X-Accel-Buffering: no` so nginx-class proxies stream events without buffering out of the box (nginx strips the header before the client sees it; Caddy/Cloudflare ignore it). The health-probe guidance is also upgraded from "optional" to a recommendation — keep the bare `/livez`/`/readyz`/`/healthz` paths internal (a public `/readyz` turns each hit into a ClickHouse `Ping`) and expose only `/v1/health` publicly.
 - **Coverage publishing — a self-hosted Go coverage README badge and GitHub Code Quality PR comments** (`.github/workflows/ci.yml`, `.github/actionlint.yaml` (new), `scripts/cov/main.go`, `scripts/ci/publish-badge.sh` (new), `.testcoverage.yml`, `go.mod`/`go.sum`, `README.md`, `AGENTS.md`, `docs/src/content/docs/development.md`): closes #133, now that the repo is public. Two published surfaces, both **non-gating** — `make cov`'s thresholds stay the only merge gate. (1) **README badge**: a new `cov badge` subcommand renders a [shields.io endpoint](https://shields.io/endpoint) JSON for the merged Go total using the *exact* number `threshold.total` gates (same `.testcoverage.yml` excludes), and a new non-gating `badge` job — the sole holder of `contents:write`, running only on trusted main — publishes it to an orphan `badges` branch via `scripts/ci/publish-badge.sh`, which the README reads over `raw.githubusercontent.com` (unrestricted for a public repo). (2) **PR comments**: the `coverage` job converts the merged Go profile to Cobertura (`go tool gocover-cobertura`, a new pinned Go `tool` dependency, with `-ignore-dirs` mirroring the YAML's global excludes) and uploads it to GitHub Code Quality via `actions/upload-code-coverage` (`code-quality: write`); the `github-code-quality[bot]` posts the aggregate + per-file diff-vs-`main` comment. The upload is `continue-on-error` so this public-preview GitHub feature can never red CI, and fork PRs skip it (no `code-quality` token, per GitHub's own guard). `actionlint` doesn't recognize the preview `code-quality` permission scope yet, so a new `.github/actionlint.yaml` suppresses only that one message. Requires the repo's *Settings → Code quality* enablement for the comments to render. Full design in `.github/workflows/README.md` §"Coverage publishing".