[FEATURE] Saved searches

## Summary

Allow named, persisted filter sets to be saved and recalled from the UI, eliminating the need to re-enter common search combinations every session.

## Motivation

Power users apply the same filters repeatedly — "production errors today", "billing debug last hour", "all PII-pattern matches". Saved searches turn these into one-click operations.

## Proposed API

```
GET /api/searches list saved searches
POST /api/searches create a saved search
GET /api/searches/{name} get one saved search
PUT /api/searches/{name} update a saved search
DELETE /api/searches/{name} delete a saved search
GET /api/searches/{name}/execute run and return matching log entries
```

### Payload

```json
{
"name": "production-errors-today",
"label": "Production errors today",
"filters": {
"level": "error",
"app_id": "production",
"date_from": "today"
}
}
```

`date_from` supports relative values: `today`, `-1h`, `-6h`, `-24h`, `-7d` — resolved at execution time.

## Storage

- **MariaDB**: `saved_searches` table (`name`, `label`, `filters` JSON, `created_at`)
- **File**: `searches.json` alongside `retention.json`, managed by a `FileSearchRepository`

## UI integration

- "Saved searches" dropdown in the Search screen
- "Save current search" button captures the active filter state and opens a name input

## Acceptance criteria

- [ ] Full CRUD via REST API
- [ ] Relative date values (`today`, `-1h`, `-24h`, `-7d`) resolved at execution time
- [ ] `/execute` returns the same response shape as `GET /api/logs`
- [ ] Works for both MariaDB and file storage backends
- [ ] Migration adds `saved_searches` table (MariaDB)
- [ ] `FileSearchRepository` implemented for file mode
- [ ] Unit tests for relative date resolution
- [ ] OpenAPI spec updated
- [ ] UI prompt updated to include saved searches dropdown in Search screen

Start by comparing the proposed searches.json file with retention.json and locating the FileSearchRepository and existing /api/logs response path. Then trace the MariaDB migration and Search screen integration. Done means CRUD, execution-time relative dates, both storage backends, unit tests, the OpenAPI update, and the saved-searches UI prompt are covered.

Written by the indexing model from the issue text.