fix: reduce ClickHouse log noise, admin query spam, and diagram scan perf

- Set com.clickhouse log level to INFO and org.apache.hc.client5 to WARN
- Admin hooks (useUsers/useGroups/useRoles) now only fetch on admin pages,
  eliminating AUDIT view_users entries on every UI click
- Add ClickHouse projection on route_diagrams for (tenant_id, route_id,
  instance_id, created_at) to avoid full table scans on diagram lookups
- Bump @cameleer/design-system to v0.1.28 (PAUSED mode time range fix,
  refreshTimeRange API)
- Call refreshTimeRange before invalidateQueries in PAUSED mode manual
  refresh so sidebar clicks use current time window

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/api/queries/admin/rbac.ts

@@ -108,10 +108,11 @@ export function useRbacStats() {
 
 // ── User Query Hooks ───────────────────────────────────────────────────
 
-export function useUsers() {
+export function useUsers(enabled = true) {
   return useQuery({
     queryKey: ['admin', 'users'],
     queryFn: () => adminFetch<UserDetail[]>('/users'),
+    enabled,
   });
 }
 
@@ -125,10 +126,11 @@ export function useUser(userId: string | null) {
 
 // ── Role Query Hooks ───────────────────────────────────────────────────
 
-export function useRoles() {
+export function useRoles(enabled = true) {
   return useQuery({
     queryKey: ['admin', 'roles'],
     queryFn: () => adminFetch<RoleDetail[]>('/roles'),
+    enabled,
   });
 }
 
@@ -142,10 +144,11 @@ export function useRole(roleId: string | null) {
 
 // ── Group Query Hooks ──────────────────────────────────────────────────
 
-export function useGroups() {
+export function useGroups(enabled = true) {
   return useQuery({
     queryKey: ['admin', 'groups'],
     queryFn: () => adminFetch<GroupDetail[]>('/groups'),
+    enabled,
   });
 }