[hoalongnatsu]

What does this PR do?

Keeps Kubernetes investigations useful during long-running operation and preserves
new issue and Timeline evidence for later analysis, without redesigning the explorer.

• History that outlives the live resource: capture issue observations, confirmed
  recovery, deletion and recurrence alongside changes and crashes. Collection runs
  without an open browser or notification channel. Historical totals remain
  separate from current active-issue counts.
• Retained investigation windows: use the existing time selector for 7 days,
  30 days, 90 days or all retained evidence. Filters and pagination stay available;
  missing coverage is not reported as proof that nothing happened.
• Storage policy suited to the backend: PostgreSQL history has no automatic
  application age, record-count or total-byte retention cap. File storage uses
  explicit 24-hour, 5,000-record and 4-MiB aggregate history budgets, protecting
  active issue state rather than silently discarding it. Memory storage remains
  ephemeral. These policies concern new captures, not an import of older history.
• Synchronization that recovers: resume background work after supported token
  renewal, temporary provider/upstream failures and worker interruptions without
  depending on a page visit or process restart. Refresh supported AWS signing
  sessions and EKS bearer tokens as separate lifetimes, with bounded retries.
• Steady, truthful existing views: retain the last authorized committed snapshot
  during ordinary refresh failures. Do not replace it with warming zeros, falsely
  resolve issues or label query time as snapshot time. Routine refreshes keep the
  existing top-bar indicator; Preparing does not return after first publication.
• Permission loss handled safely: remove protected browser data on confirmed
  whole-scope denial, keep the failure visible and recover automatically after
  reauthorization. Isolated unreadable resource types do not unnecessarily block
  other authorized data. Partial recovery remains labelled Degraded where appropriate.

Raw container-log capture retains its existing separate limits. Static expired AWS
sessions and directly supplied bearer tokens cannot renew themselves; renewable
providers or externally replaced credentials are still required.

Why?

A long-running collector should not get trapped in a credential/retry loop, erase
useful views during refresh, or lose investigation evidence when Pods disappear.
Operators also need a clear distinction between incomplete evidence, denied access
and an actual healthy empty result.

Type of change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Breaking change (config / API / default behavior)
• Documentation only
• Refactor (no functional change)
• CI / build / chore

The resource-detail page is split into focused components with its existing public
behavior preserved. Persistent history starts with new captures; older history is
not imported. PostgreSQL capacity and intentional deletion remain operator-managed.

Checklist

• go test ./... passes locally on the final release/CI snapshot
• go vet ./... is clean in recorded affected-package validation
• Added or updated tests for the change
• Updated user-facing docs under src/ for changed behavior
• Updated ROADMAP.md if this closes a roadmap item
• No secrets, tokens, or webhook URLs introduced in source / YAML
• No new third-party dependencies