feat: time-window grouping for streaming data

[mpryor]

Summary

Group streaming log lines into time-based buckets (per second, minute, hour) and display counts or aggregations per window.

Details

• Group rows by time windows using arrival time (feat: hidden arrival timestamp metadata column for log ordering #29) or a parsed timestamp column
• Display as a summary view: time bucket + count (+ optional aggregations from feat: column aggregations (mean, min, max, sum) #32)
• Configurable window size (1s, 5s, 30s, 1m, 5m, 1h, etc.)
• Drill into a time bucket to see the underlying rows

Use Cases

• Spotting traffic spikes or error bursts in live logs
• Measuring request rate over time
• Identifying quiet periods or outages
• Comparing activity patterns across time windows

Considerations

• Relationship with feat: hidden arrival timestamp metadata column for log ordering #29 (arrival timestamp) and feat: column aggregations (mean, min, max, sum) #32 (aggregations)
• Live updating in tail mode as new data arrives
• Sliding vs tumbling windows
• Display format — inline summary rows, separate view, or sparkline/bar chart