[viethqb]

Summary

This PR documents the StarRocks Query log tab and the security model behind it. It goes with egret-data/platform feat/starrocks-query-log (egret-data/platform#849).

Changes

• control-plane/query-engines/engine-detail.md: the Query log tab. It covers:
  • the four states;
  • the filters and columns;
  • User vs Connected as;
  • the side panel;
  • the engine:audit gating;
  • setup, both automatic and through Set up query log;
  • 30-day retention;
  • pluginNotShipped and Upgrade security.
• deploy-operate/engines-and-ranger.md: covers:
  • the audit database and the egret_query_log loader;
  • the Ranger loader and guard rows;
  • what is redacted;
  • the plugin_enable and plugin_dir keys, which are now refused in feConfig;
  • the count(*) known limit.
• deploy-operate/security-hardening.md: grant engine:audit sparingly.
• reference/permissions.md: engine:audit.
• deploy-operate/upgrade.md: migration 0218, existing engines, and pre-egret.4 images.
• REST API reference: the four /engines/{id}/query-log routes.
• Four screenshots, taken on a kind deployment of the platform branch.

The facts these pages rely on were measured on a real FE and on kind. Specifically:

• the plugin survives FE pod re-creation;
• errors are recorded as codes only;
• StarRocks already stores *** for passwords.

Test plan

• npm run build passes for en and vi.
• I checked each screenshot against the text that describes it.

🤖 Generated with Claude Code