docs(data-stream): rework the Data Stream section and split its reference into settings, data sources, templates, and endpoints

[marcus-souza-azion]

What & why

The Data Stream Overview carried four kinds of page in one file: an overview, a settings and variables reference for four data sources and eleven endpoints, a click-through for creating and deleting streams, and a limits table. The Quickstart was a stub with no stages. The guides kept "How to" titles, taught a retired API body, and described a Console form that now filters by workloads, not domains. This PR rebuilds the section on the product section skeleton, in English and Portuguese.

• Section pages: a new Overview with a stream specimen and an event-to-endpoint diagram, a tabbed Quickstart (Console and API) that streams Activity History to an Object Storage bucket and confirms the delivery, How it works, Limits with the usage each plan includes, Best practices, Troubleshooting, and Glossary. Data Stream nests no Products, so the section has no dropdowns.
• Reference: the old Overview's tables become Stream settings, Data sources and variables, Templates and payload, and Endpoints. Each table names the Console label beside the API field.
• Guides: the hub lists 21 guides, up from 20. Every endpoint guide is rewritten as a tabbed "Send logs to …" guide with an API panel, and new guides cover Apache Kafka and IBM QRadar. The WAF to SIEM guide joins the hub and moves to the Firewall and WAF guides group; the debug rules guide is tagged.
• Retired: the "How to configure Data Stream main settings" guide (its create path moves into the Quickstart, its edit steps into "Edit, stop, or delete a stream"), the associate-domains and select-variables guides, the Stream data journey page, and Understand Data Stream metrics. SIEM Azion moves to the Real-Time Metrics reference group. Every move redirects.
• Verified: every API example ran against the live API v4, and responses are anonymized. Console labels come from the public Console bundle. This corrects what the old pages carried: the data sources are activity_history, workloads, functions_console, and waf; a stream carries exactly one of a sampling or a workload filter transform; saving a sampled stream deactivates every other stream; the Console filters by workloads; deleting a stream asks for its name; and an Object Storage credential needs the bucket-list capabilities to receive logs. The usage-data guide's GraphQL query, which failed with 400, is corrected.
• Coverage: measured on the same frozen question set before and after, answered questions rose from 117 of 249 to 239 of 249.

**Related issue:**MM-16059
Pages affected: Data Stream, /documentation/platform/data-stream/ and its pages (EN and PT); its guides under /documentation/guides/platform/observability/ and the WAF to SIEM guide; src/nav/trees/data-stream.json, src/nav/trees/guides.json, src/nav/trees/real-time-metrics.json, src/nav/redirects.json, cicd/massive-redirect/. 113 files: 22 added (11 English, 11 Portuguese), 81 changed (38 English pages, 37 Portuguese, 6 nav and redirect files), 10 deleted (5 retired pages in each language).

Type of change

• 🆕 New content (feat)
• 🩹 Fix (fix) — typo, broken link, wrong information
• ♻️ Content update (docs) — rewrite, expansion, upkeep
• 🌐 Translation sync (i18n)
• 🏗️ Platform / structure (refactor / chore) — reviewed by UXE, no content mixed in

Author checklist

• PR title follows type(scope): summary (see GOVERNANCE.md §4)
• Frontmatter complete: title, description, meta_tags, namespace, permalink, last_reviewed
• No legacy "edge-" product names in the copy
• How-to/tutorial content includes at least one runnable, copy-paste-tested code block
• Screenshots (if any) have alt text and follow image standards
• Internal links are relative and resolve locally
• If any permalink changed or page moved: redirect added in this PR
• i18n: pt-br updated in this PR or follow-up i18n
• I ran pnpm build:local (build + frontmatter check) without errors