Replace the Service Map's HTTP polling (~133 req/s of full rebuilds) with the
SSE snapshot contract used by logs/metrics, and fix the layout reflow that made
the graph visibly "flash" whenever the topology changed.

Server:
- packages/core: persistent, never-pruned cumulative aggregate
  (accumulateSpan / projectServiceMap) that resolves cross-service edges
  out-of-order (SERVER parents arrive after children), dedups per span, and
  windows edge latency while keeping call/error counts cumulative
- traceStore: aggregate folded in on ingest, serviceMapSeq cursor + memoised
  projection; reset only on clearTraces; rebuilt on replaceAllTraces
- new /api/service-map/stream SSE endpoint (map-count / map-snapshot)

Client:
- serviceMap.svelte.ts store (snapshot-on-connect, first-load-only loading,
  REST fallback)
- createStickyLayout: persistent per-node placements so placed nodes never
  move; new nodes append and the canvas grows (expand-only)
- +page.svelte: drop fetchServiceMap + 2s interval; keep <ServiceMap> mounted

Validated live: 0 polls (was 798/6s), existing nodes never reposition, counts
update in place, new services appear without moving incumbents, no flash.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…ADME

- broaden the intro to traces, logs, and metrics
- describe the snapshot+delta SSE streaming shared by all live views, the
  flicker-free render fixes, and the cumulative expand-only service map
- add a Metrics feature bullet, "Sending Metrics" section, and screenshot
- document OTEL_GUI_MAX_METRICS / OTEL_GUI_MAX_METRIC_POINTS and the new
  metrics + *_/stream API endpoints
- add the `c` (Metrics tab) shortcut and uPlot to the tech stack

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Browser-based OTLP exporters issue cross-origin requests to /v1/* and
/api/*. Anything beyond a simple request (e.g. application/x-protobuf or
custom headers) triggers a preflight OPTIONS that SvelteKit did not
answer, and every response was missing Access-Control-Allow-Origin, so
the browser discarded it.

Add a server hook that answers CORS preflights and attaches CORS headers
to OTLP ingest and read API responses, with an OTEL_GUI_CORS_ORIGIN knob
(default "*", or a comma-separated allow-list). Policy logic lives in a
pure, unit-tested module.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Feat/cors support - single sse stream

# Conflicts:
#	README.md

Deep, in-memory search across traces, logs, and metrics — matching message
bodies, span names, status, events, and every attribute — exposed three ways:

- Store: searchLogs/searchTraces/searchMetrics/searchAll + listServices on the
  in-memory trace store, plus reusable match primitives in @otel-gui/core.
- MCP: localhost-only JSON-RPC endpoint at POST /mcp (search, search_*, get_*,
  list_services, get_service_map, and a write-only flush tool). Loopback-guarded
  by default; OTEL_GUI_MCP_ALLOW_REMOTE=1 relaxes it for Docker/proxy.
- UI: GET /api/search backs the per-tab search boxes, which now query the server
  deep-search (with a client-side substring fallback) and show matchedIn hints.

Add POST /api/flush + a global Flush button + MCP flush tool to clear all
buffers (traces, logs, metrics, service map) for clean-state captures.

Document all missing env vars in .env.example (PORT, MAX_METRICS,
MAX_METRIC_POINTS, MCP_ENABLED, MCP_ALLOW_REMOTE, license PEM/clock-skew).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Brings in upstream metafab/main (8899c62): prefer log.record.uid as the
stored log ID when present, and URL-encode dynamic IDs to keep routes safe
when IDs contain reserved characters (/, ?, :).

Conflicts (Logs.svelte, Traces.svelte): our fork navigates row clicks via
client-side goto() to avoid tearing down every SSE stream on each open
(the 6-connection-per-origin stall fix); upstream switched to
window.location.href but added encodeURIComponent(). Resolved by keeping
client-side goto() AND wrapping the id in encodeURIComponent() — both the
no-reload behaviour and the URL-safety fix are preserved. Row keydown
handlers (ours) retained.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>