Bucketeer UI (dark mode, pagination, virtual scroll), readable+indexed resources, LLM-friendly logs

Logging:
- structured slog with LOG_FORMAT=json|text and a stable key vocabulary
- periodic stats record with queue depths, db pool, goroutines, memory, dns/probe
- no per-certificate logging (hot path is counters only)

UI (Bucketeer branding, DESIGN.md):
- light+dark themes (OS default, persisted header toggle, no first-paint flash)
- official mascot: lossless WebP light/dark logos + favicon, embedded and served
  with cache headers (1.2MB source PNGs -> ~27/22KB webp)
- Assets/Contents views, pagination (offset) and native virtual scrolling
  (content-visibility) so large result sets do not blow up the DOM
- search with debounce/abort + URL state, exposure chips, sort, summary counts

Readability + indexing:
- internal/index listers for S3-compatible, GCS, Azure, Firebase, OpenSearch
  (metadata only: keys/sizes/dates; never object contents)
- asset_entries table + store write/search; readable resources are indexed and
  searchable in the UI
- deep, unauthenticated, read-only DB probes (PROBE_DEEP): Redis PING,
  PostgreSQL StartupMessage, MongoDB OP_MSG listDatabases; OpenSearch/Neptune
  HTTP reads
- Azure account-level listing fixed: 403 is reported reachable, not
  auth_required, since anonymous access is per-container

DNS:
- curated reliable resolvers by default; DNS_SERVERS=fresh adds the compiled-in
  Fresh-Resolvers snapshot with a bounded startup sample (warming all 6.7k at
  once broke the container resolver)
- random healthy selection + failover + per-server cooldown

Other: prober Close fixes a shutdown hang; config/README updated.

internal/store/store_test.go

@@ -66,7 +66,21 @@ func TestIntegration(t *testing.T) {
 	if _, err := s.ListAssets(ctx, AssetFilter{Provider: "aws", Limit: 10}); err != nil {
 		t.Fatal(err)
 	}
+	if _, err := s.CountAssets(ctx, AssetFilter{Provider: "aws"}); err != nil {
+		t.Fatal(err)
+	}
 	if _, err := s.Stats(ctx); err != nil {
 		t.Fatal(err)
 	}
+	n, err := s.ReplaceEntries(ctx, model.ProviderAWS.String(), model.ServiceS3.String(), f.Hostname, []model.Entry{
+		{Kind: "object", Name: "it/index/a.txt", Size: 10},
+		{Kind: "prefix", Name: "it/index/"},
+	})
+	if err != nil || n != 2 {
+		t.Fatalf("ReplaceEntries = %d, %v", n, err)
+	}
+	entries, total, err := s.SearchEntries(ctx, "index/a", 10, 0)
+	if err != nil || total != 1 || len(entries) != 1 || entries[0].ProviderHost != f.Hostname {
+		t.Fatalf("SearchEntries = %+v total=%d err=%v", entries, total, err)
+	}
 }