Bucketeer UI (dark mode, pagination, virtual scroll), readable+indexed resources, LLM-friendly logs

Logging:
- structured slog with LOG_FORMAT=json|text and a stable key vocabulary
- periodic stats record with queue depths, db pool, goroutines, memory, dns/probe
- no per-certificate logging (hot path is counters only)

UI (Bucketeer branding, DESIGN.md):
- light+dark themes (OS default, persisted header toggle, no first-paint flash)
- official mascot: lossless WebP light/dark logos + favicon, embedded and served
  with cache headers (1.2MB source PNGs -> ~27/22KB webp)
- Assets/Contents views, pagination (offset) and native virtual scrolling
  (content-visibility) so large result sets do not blow up the DOM
- search with debounce/abort + URL state, exposure chips, sort, summary counts

Readability + indexing:
- internal/index listers for S3-compatible, GCS, Azure, Firebase, OpenSearch
  (metadata only: keys/sizes/dates; never object contents)
- asset_entries table + store write/search; readable resources are indexed and
  searchable in the UI
- deep, unauthenticated, read-only DB probes (PROBE_DEEP): Redis PING,
  PostgreSQL StartupMessage, MongoDB OP_MSG listDatabases; OpenSearch/Neptune
  HTTP reads
- Azure account-level listing fixed: 403 is reported reachable, not
  auth_required, since anonymous access is per-container

DNS:
- curated reliable resolvers by default; DNS_SERVERS=fresh adds the compiled-in
  Fresh-Resolvers snapshot with a bounded startup sample (warming all 6.7k at
  once broke the container resolver)
- random healthy selection + failover + per-server cooldown

Other: prober Close fixes a shutdown hang; config/README updated.

internal/webui/webui_test.go

@@ -19,8 +19,16 @@ func (f *fakeStore) ListAssets(ctx context.Context, fl store.AssetFilter) ([]sto
 	return []store.Asset{{ID: 1, Provider: "aws", Service: "s3", ProviderHost: "b.s3.amazonaws.com", Exposure: "public_read"}}, nil
 }
 
+func (f *fakeStore) CountAssets(ctx context.Context, fl store.AssetFilter) (int, error) {
+	return 1, nil
+}
+
+func (f *fakeStore) SearchEntries(ctx context.Context, query string, limit, offset int) ([]store.IndexEntry, int, error) {
+	return []store.IndexEntry{{ID: 7, Kind: "object", Name: "photos/a.jpg", ProviderHost: "b.s3.amazonaws.com"}}, 1, nil
+}
+
 func (f *fakeStore) Stats(ctx context.Context) (store.Stats, error) {
-	return store.Stats{Total: 1, Readable: 1}, nil
+	return store.Stats{Total: 1, Readable: 1, Entries: 1}, nil
 }
 
 func TestAPI(t *testing.T) {
@@ -36,12 +44,31 @@ func TestAPI(t *testing.T) {
 	if resp.StatusCode != http.StatusOK {
 		t.Fatalf("status = %d", resp.StatusCode)
 	}
-	var assets []store.Asset
-	if err := json.NewDecoder(resp.Body).Decode(&assets); err != nil {
+	var payload struct {
+		Assets []store.Asset `json:"assets"`
+		Total  int           `json:"total"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&payload); err != nil {
 		t.Fatal(err)
 	}
-	if len(assets) != 1 || fs.lastFilter.Provider != "aws" || fs.lastFilter.Query != "bucket" || fs.lastFilter.Limit != 5 {
-		t.Fatalf("unexpected assets/filter: %+v %+v", assets, fs.lastFilter)
+	if len(payload.Assets) != 1 || payload.Total != 1 || fs.lastFilter.Provider != "aws" || fs.lastFilter.Query != "bucket" || fs.lastFilter.Limit != 5 {
+		t.Fatalf("unexpected assets/filter: %+v %+v", payload, fs.lastFilter)
+	}
+
+	entriesResp, err := http.Get(srv.URL + "/api/entries?q=photos")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer entriesResp.Body.Close()
+	var entriesPayload struct {
+		Entries []store.IndexEntry `json:"entries"`
+		Total   int                `json:"total"`
+	}
+	if err := json.NewDecoder(entriesResp.Body).Decode(&entriesPayload); err != nil {
+		t.Fatal(err)
+	}
+	if len(entriesPayload.Entries) != 1 || entriesPayload.Total != 1 {
+		t.Fatalf("unexpected entries: %+v", entriesPayload)
 	}
 
 	statsResp, err := http.Get(srv.URL + "/api/stats")