Add safe on-demand field distributions and top values

[VibeSWE]

Logs and Datasets need a quick way to inspect common field values without writing aggregation SQL. The existing /dataset_stats handler is a starting point, but authorization and SQL construction need review before native UI integration. These are source-review findings, not a demonstrated exploit.

Start with an explicitly opened panel for selected dataset, fields and time range. Authorize the source dataset independently of the internal statistics stream. Enforce tenant isolation and applicable tag restrictions; deny requests when precomputed aggregates cannot preserve those restrictions. Correct dataset-name literal escaping in build_stats_sql and validate bounded pagination with checked arithmetic.

Acceptance criteria

• Authorized users can retrieve selected fields’ top values/counts; unauthorized source datasets and cross-tenant access are rejected.
• Tests cover quoting, tenant/tag restrictions, unavailable statistics, invalid pagination and excessive limits.
• Show loading, empty, unavailable and error states. Disclose collection lag, approximation/truncation and per-field pagination limits; explicitly state when freshness/completeness is unknown.
• Requests run on demand and are cancelled or ignored when dataset/time selection changes.

The tool named get_dataset_stats returns ordinary stream statistics, not field distributions. Exact arbitrary-filter aggregation, background polling and a new statistics pipeline are out of scope.

Suggested order: after source-authorization and SQL-construction prerequisites are addressed.