fix(logs): stop hasToken and hasAny/hasAll 500s on separator and big int needles

[tushar-signoz]

Two pre-existing logs-filter 500s in the has-family functions, each turned into correct behavior.

What

• hasToken separator/whitespace needle → clean 400 (was 500, both modes). A needle like user_id, an IP, or a UUID contains a ClickHouse token separator; CH rejects it (code 36, "Needle must not contain whitespace or separator characters") and it surfaced as a 500. Now validated up front in conditionForHasToken — the single choke point both the legacy and JSON body paths flow through — returning a 400 that points at CONTAINS for multi-token search.
• hasAny/hasAll on a quoted integer ≥ 2³² → real match (was 500, legacy flag-off only). clickhouse-go binds the needle as a concrete Array(UInt64), which has no supertype with the Array(Nullable(Int64)) extraction that hasAny/hasAll must unify (code 386, NO_COMMON_TYPE). The needle array is now CAST(… AS Array(Int64)) to match the extraction.

Guardrails

• hasToken: one guard at the single choke point; no SQL change for valid single-token needles.
• hasAny/hasAll: the CAST is scoped to the Int64 element type and the legacy path only — JSON mode already handles big ints via typed body_v2 columns, so it's untouched. String/Float64 SQL is unchanged.
• Scalar has() and the scalar OR-fallback are value-level coercion and don't hit the array supertype, so they're unaffected (verified they don't 386).

Notes

• Both bugs are pre-existing, not tied to the recent has-family revamp.
• The big-int fix was verified against the exact target ClickHouse 25.12.5: reproduced code 386 with a concrete Array(UInt64) needle for both hasAny/hasAll, confirmed the CAST … AS Array(Int64) returns the correct match, and confirmed the scalar IN/= fallback does not 386.

Testing

• Go unit tests: hasToken separator/whitespace needles → 400; legacy Int64 hasAny/hasAll big-int needles assert the CAST(… AS Array(Int64)) in the generated SQL.
• Integration regression tests flipped from capturing the 500 to the fixed behavior: hasToken separator → 400 (legacy + JSON); hasAny/hasAll big int → 200 with an exact single match (renamed …_errors → …_matches).
• make go-lint → 0 issues; make py-fmt / make py-lint clean.