Bucketeer UI (dark mode, pagination, virtual scroll), readable+indexed resources, LLM-friendly logs

Logging:
- structured slog with LOG_FORMAT=json|text and a stable key vocabulary
- periodic stats record with queue depths, db pool, goroutines, memory, dns/probe
- no per-certificate logging (hot path is counters only)

UI (Bucketeer branding, DESIGN.md):
- light+dark themes (OS default, persisted header toggle, no first-paint flash)
- official mascot: lossless WebP light/dark logos + favicon, embedded and served
  with cache headers (1.2MB source PNGs -> ~27/22KB webp)
- Assets/Contents views, pagination (offset) and native virtual scrolling
  (content-visibility) so large result sets do not blow up the DOM
- search with debounce/abort + URL state, exposure chips, sort, summary counts

Readability + indexing:
- internal/index listers for S3-compatible, GCS, Azure, Firebase, OpenSearch
  (metadata only: keys/sizes/dates; never object contents)
- asset_entries table + store write/search; readable resources are indexed and
  searchable in the UI
- deep, unauthenticated, read-only DB probes (PROBE_DEEP): Redis PING,
  PostgreSQL StartupMessage, MongoDB OP_MSG listDatabases; OpenSearch/Neptune
  HTTP reads
- Azure account-level listing fixed: 403 is reported reachable, not
  auth_required, since anonymous access is per-container

DNS:
- curated reliable resolvers by default; DNS_SERVERS=fresh adds the compiled-in
  Fresh-Resolvers snapshot with a bounded startup sample (warming all 6.7k at
  once broke the container resolver)
- random healthy selection + failover + per-server cooldown

Other: prober Close fixes a shutdown hang; config/README updated.

docker-compose.yml

@@ -34,18 +34,16 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
+    # All optional tuning (DNS_SERVERS, PROBE_*, UI_USER, ...) comes from .env.
+    # Leave DNS_SERVERS unset to use the curated + community resolver list.
+    env_file:
+      - .env
     environment:
-      DATABASE_URL: ${DATABASE_URL:?set DATABASE_URL in .env}
       METRICS_ADDR: ":9090"
-      LOG_LEVEL: ${LOG_LEVEL:-info}
-      DNS_SERVERS: ${DNS_SERVERS:-1.1.1.1:53,8.8.8.8:53,1.0.0.1:53}
-      DNS_WORKERS: ${DNS_WORKERS:-16}
-      ACTIVE_PROBING: ${ACTIVE_PROBING:-false}
-      # START_AT_END: "true"   # skip historical certificates on first run
-    # Metrics/health are bound to loopback only: scrape from the host or a
-    # sidecar, never expose them publicly (there is no auth on this listener).
+    # Loopback by default. Set UI_BIND=0.0.0.0 in .env to reach the UI/metrics
+    # from another host (there is no auth unless UI_USER/UI_PASS is set).
     ports:
-      - "127.0.0.1:9090:9090"
+      - "${UI_BIND:-127.0.0.1}:9090:9090"
     # No application volume: the container is stateless apart from PostgreSQL.
     read_only: true
     tmpfs: