Fix column order and byte counts in the log tables

Three defects, all mine.

Column order was ignored because organize's indexByName was keyed on the
renamed display labels. Grafana keys it on the original field names, so the
mapping matched nothing and the order fell back to whatever order the frames
arrived in — which is why the raw line landed second. Every table is affected,
not just the access one.

The byte count was wrong for the NCSA sources: a trailing `pattern` capture
takes the rest of the line, so `<size>` held `16 "-" "kube-probe/1.35"` rather
than 16, and for nginx it swallowed the whole referer and user-agent. Replaced
with a `regexp` parser bounding the capture on \d+, which also handles both
line shapes — Keycloak's access line ends at the size while gunicorn's and
nginx's carry more fields after it.

Access log columns are now time, status, method, path, source, client, latency,
bytes, raw line, with the raw record last in every table.

gunicorn and nginx now share one query since their format is identical, which
also halves the duplicate class names the status panel showed — one series per
query returning the same class.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -251,6 +251,17 @@ Latency is populated for Kong only: the NCSA format the other sources use
 carries no timing field. That is a property of the format, not a gap in the
 query.
 
+The NCSA sources are read with `regexp`, not `pattern`. A trailing `pattern`
+capture consumes the rest of the line, so a `<size>` at the end swallowed the
+referer and user-agent along with the byte count. Bounding the capture on `\d+`
+stops it at the number, and `regexp` tolerates both shapes — Keycloak's access
+line ends at the size, gunicorn's and nginx's carry more fields after it.
+
+In every table the raw record is the last column, and the `organize`
+transformation's `indexByName` keys on the original field names rather than the
+renamed labels — keying it on the display names silently leaves the column order
+to whatever order the frames arrived in.
+
 ### Parsed log tables### Parsed log tables
 
 Every dashboard shows its logs twice: a **table** with one column per parsed