Bucketeer UI (dark mode, pagination, virtual scroll), readable+indexed resources, LLM-friendly logs

Logging:
- structured slog with LOG_FORMAT=json|text and a stable key vocabulary
- periodic stats record with queue depths, db pool, goroutines, memory, dns/probe
- no per-certificate logging (hot path is counters only)

UI (Bucketeer branding, DESIGN.md):
- light+dark themes (OS default, persisted header toggle, no first-paint flash)
- official mascot: lossless WebP light/dark logos + favicon, embedded and served
  with cache headers (1.2MB source PNGs -> ~27/22KB webp)
- Assets/Contents views, pagination (offset) and native virtual scrolling
  (content-visibility) so large result sets do not blow up the DOM
- search with debounce/abort + URL state, exposure chips, sort, summary counts

Readability + indexing:
- internal/index listers for S3-compatible, GCS, Azure, Firebase, OpenSearch
  (metadata only: keys/sizes/dates; never object contents)
- asset_entries table + store write/search; readable resources are indexed and
  searchable in the UI
- deep, unauthenticated, read-only DB probes (PROBE_DEEP): Redis PING,
  PostgreSQL StartupMessage, MongoDB OP_MSG listDatabases; OpenSearch/Neptune
  HTTP reads
- Azure account-level listing fixed: 403 is reported reachable, not
  auth_required, since anonymous access is per-container

DNS:
- curated reliable resolvers by default; DNS_SERVERS=fresh adds the compiled-in
  Fresh-Resolvers snapshot with a bounded startup sample (warming all 6.7k at
  once broke the container resolver)
- random healthy selection + failover + per-server cooldown

Other: prober Close fixes a shutdown hang; config/README updated.

internal/webui/webui.go

@@ -1,12 +1,13 @@
-// Package webui serves a small read-only web UI over the discovered cloud
-// assets. It is intentionally dependency-free (stdlib + embedded HTML) and
+// Package webui serves a small read-only web UI over discovered cloud assets
+// and their content index. It is dependency-free (stdlib + embedded HTML) and
 // exposes no mutation endpoints.
 package webui
 
 import (
 	"context"
-	_ "embed"
+	"embed"
 	"encoding/json"
+	"io/fs"
 	"net/http"
 	"strconv"
 	"strings"
@@ -17,9 +18,14 @@ import (
 //go:embed index.html
 var indexHTML []byte
 
+//go:embed assets
+var assetsFS embed.FS
+
 // Store is the read-only subset of the database the UI needs.
 type Store interface {
 	ListAssets(ctx context.Context, f store.AssetFilter) ([]store.Asset, error)
+	CountAssets(ctx context.Context, f store.AssetFilter) (int, error)
+	SearchEntries(ctx context.Context, query string, limit, offset int) ([]store.IndexEntry, int, error)
 	Stats(ctx context.Context) (store.Stats, error)
 }
 
@@ -31,6 +37,9 @@ type Config struct {
 // New returns the UI handler. If Config.User is set, all routes require basic auth.
 func New(s Store, cfg Config) http.Handler {
 	mux := http.NewServeMux()
+	assets, _ := fs.Sub(assetsFS, "assets")
+	fileServer := http.FileServer(http.FS(assets))
+	mux.Handle("/assets/", http.StripPrefix("/assets/", cacheForever(fileServer)))
 	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path != "/" {
 			http.NotFound(w, r)
@@ -43,19 +52,37 @@ func New(s Store, cfg Config) http.Handler {
 		q := r.URL.Query()
 		limit, _ := strconv.Atoi(q.Get("limit"))
 		offset, _ := strconv.Atoi(q.Get("offset"))
-		assets, err := s.ListAssets(r.Context(), store.AssetFilter{
+		f := store.AssetFilter{
 			Provider: strings.TrimSpace(q.Get("provider")),
 			Service:  strings.TrimSpace(q.Get("service")),
 			Exposure: strings.TrimSpace(q.Get("exposure")),
 			Query:    strings.TrimSpace(q.Get("q")),
+			Sort:     strings.TrimSpace(q.Get("sort")),
 			Limit:    limit,
 			Offset:   offset,
-		})
+		}
+		assets, err := s.ListAssets(r.Context(), f)
 		if err != nil {
 			http.Error(w, err.Error(), http.StatusInternalServerError)
 			return
 		}
-		writeJSON(w, assets)
+		total, err := s.CountAssets(r.Context(), f)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		writeJSON(w, map[string]any{"assets": assets, "total": total, "limit": limit, "offset": offset})
+	})
+	mux.HandleFunc("/api/entries", func(w http.ResponseWriter, r *http.Request) {
+		q := r.URL.Query()
+		limit, _ := strconv.Atoi(q.Get("limit"))
+		offset, _ := strconv.Atoi(q.Get("offset"))
+		entries, total, err := s.SearchEntries(r.Context(), strings.TrimSpace(q.Get("q")), limit, offset)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		writeJSON(w, map[string]any{"entries": entries, "total": total, "limit": limit, "offset": offset})
 	})
 	mux.HandleFunc("/api/stats", func(w http.ResponseWriter, r *http.Request) {
 		st, err := s.Stats(r.Context())
@@ -72,6 +99,15 @@ func New(s Store, cfg Config) http.Handler {
 	return mux
 }
 
+// cacheForever marks embedded, content-addressed-by-name assets as long-lived,
+// since they only change with a new binary.
+func cacheForever(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "public, max-age=86400")
+		next.ServeHTTP(w, r)
+	})
+}
+
 func writeJSON(w http.ResponseWriter, v any) {
 	w.Header().Set("Content-Type", "application/json; charset=utf-8")
 	_ = json.NewEncoder(w).Encode(v)
@@ -81,7 +117,7 @@ func basicAuth(user, pass string, next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		u, p, ok := r.BasicAuth()
 		if !ok || u != user || p != pass {
-			w.Header().Set("WWW-Authenticate", `Basic realm="ctcloud"`)
+			w.Header().Set("WWW-Authenticate", `Basic realm="bucketeer"`)
 			http.Error(w, "unauthorized", http.StatusUnauthorized)
 			return
 		}