[sdairs]

Part 3 of 4 in the #1144 drift stack. Fixes #1144.

• ClickStackLogSource and ClickStackLogSourceResponse gain optional event_name_expression (eventNameExpression) and severity_number_expression (severityNumberExpression), both nullable strings in the spec. The TryFrom write-back carries both.
• Tests: the existing absent/null and wire-name tests are extended, and a new write-back round trip is added. Library README updated.
• clickhousectl reads source config files strictly into these library types, so clickstack source create|update --file accepts the new keys from this PR. It needs no code change. Part 4 pins the behaviour.

At this head, python3 scripts/check-openapi-drift.py --dry-run against the live spec reports no actionable drift. The library tests (including spec_coverage_test and the analyzer entrypoint_test), library clippy, both clickhousectl clippy configurations, cargo check --workspace --all-features and cargo test -p clickhousectl pass.

🤖 Generated with Claude Code

---

Note

Low Risk
Additive optional API model fields and conversions with expanded serde tests; no auth, networking, or behavior changes beyond accepting new JSON keys.

Overview
Aligns ClickStack log source models with the Cloud API by adding optional event_name_expression and severity_number_expression on ClickStackLogSource and ClickStackLogSourceResponse (wire names eventNameExpression / severityNumberExpression) for mapping OpenTelemetry log EventName and SeverityNumber.

TryFrom for log sources now copies both fields on response-to-request write-back. Existing serde behavior applies: absent or null stays None, set values serialize under their wire names. Struct-literal callers must set the new fields to None or use ..Default::default().

Tests cover optional/null handling, wire-name serialization, and a full JSON round trip; the crate README documents the new fields.

^{Reviewed by Cursor Bugbot for commit 6b49176. Bugbot is set up for automated code reviews on this repo. Configure here.}