Auction end times, visual flair, and pre-launch cleanup

Auction handling:
- Capture itemEndDate from eBay Browse API and ending_date from ZenMarket
  (Yahoo JP); plumb through results.ends_at column. Permissive ZenMarket
  parser (multiple layouts, JST when offset missing).
- Per-row "Ends" countdown column + "Ending soon" banner on results pages,
  live-ticked by flair.js with urgent/critical tinting under 1h/5m.
- Backfill ends_at for known auctions when their URL reappears in a poll
  (dedup hit no longer drops the new end time).
- Hide ended auctions from result listings by default via
  ResultsQuery.ExcludeEnded; rows stay in the DB.

Visual flair:
- Glassy backdrop-blur v-cards with gradient-mask borders and hover-lift.
- htmx swap fade-in via transient .v-just-swapped class.
- Count-up animation on dashboard stats. All animations gated behind
  prefers-reduced-motion.

eBay condition + region filters (auctions-style scoping):
- items.condition and items.region columns; threaded through item form,
  CreateItem/UpdateItem, scheduler eBay plan input, and previewKey so
  cache invalidates when these change.
- ebay.SearchParams gains conditionIds and itemLocationCountry filters.

Run Now reload + countdown engine:
- Run Now now sets HX-Refresh: true (non-htmx fallback: 303 redirect) so
  the entire results view — best price, chart, badge, last polled —
  reflects the new poll, instead of swapping just one partial.

Pre-launch hardening (P1 set):
- auth.EqualizeLoginTiming on no-such-user branch.
- (*App).serverError centralizes 500s; replaces err.Error() leaks across
  results/settings/items/users/dashboard handlers.
- main.go server: ReadTimeout 30s / WriteTimeout 60s / IdleTimeout 120s
  alongside the existing ReadHeaderTimeout.
- noListFS wrapper blocks static directory listings.
- Credential fields in settings no longer render value=; blank submission
  preserves the saved value, with per-field "Saved in settings / Set in
  config.toml / Not set" status indicator.

Misc:
- -debug flag wires slog to LevelDebug; raw ZenMarket items logged for
  format diagnosis.
- /healthz public endpoint for reverse-proxy probes.
- deploy/veola.service systemd unit template (hardening flags, single
  ReadWritePaths=/var/lib/veola).
- handlers_test.go covers /healthz, setup-gate redirect, auth gate, and
  /login render with httptest + in-memory sqlite.
- best_price_currency on items; templates pick the right symbol per row.
- .gitignore now excludes *.log / veola-debug.log.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/apify/types.go

@@ -2,10 +2,70 @@ package apify
 
 import (
 	"encoding/json"
+	"log/slog"
 	"strconv"
 	"strings"
+	"time"
 )
 
+// jstLocation is the timezone ZenMarket reports Yahoo Auctions JP end times
+// in when the value lacks an explicit offset. Falls back to UTC if the
+// embedded tzdata lookup fails (main.go imports time/tzdata so in practice
+// this always resolves).
+var jstLocation = func() *time.Location {
+	loc, err := time.LoadLocation("Asia/Tokyo")
+	if err != nil {
+		return time.UTC
+	}
+	return loc
+}()
+
+// yahooEndingDateLayouts is the ordered list of layouts attempted when
+// parsing ZenMarket's `ending_date`. Some entries use Local-as-JST (no
+// offset in the string) — see parseYahooEndingDate for the routing.
+var yahooEndingDateLayouts = []struct {
+	layout string
+	jst    bool // true: parse as JST; false: parse with offset/zone from string
+}{
+	{time.RFC3339, false},
+	{"2006-01-02T15:04:05", true},
+	{"2006-01-02 15:04:05", true},
+	{"2006/01/02 15:04:05", true},
+	{"2006/01/02 15:04", true},
+	{"2006-01-02 15:04", true},
+}
+
+// parseYahooEndingDate is a permissive parser for ZenMarket's ending_date
+// field. The actor's output format has shifted over time and isn't documented;
+// rather than wedging on one layout, try the known shapes in order and treat
+// anything without an explicit zone as JST (Yahoo Auctions runs in Japan).
+// Returns nil + logs a warning when nothing parses, so operators see the raw
+// value and can extend this list.
+func parseYahooEndingDate(s string) *time.Time {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return nil
+	}
+	for _, l := range yahooEndingDateLayouts {
+		var (
+			t   time.Time
+			err error
+		)
+		if l.jst {
+			t, err = time.ParseInLocation(l.layout, s, jstLocation)
+		} else {
+			t, err = time.Parse(l.layout, s)
+		}
+		if err == nil {
+			slog.Debug("yahoo ending_date parsed",
+				"raw", s, "layout", l.layout, "jst_assumed", l.jst, "parsed", t.UTC().Format(time.RFC3339))
+			return &t
+		}
+	}
+	slog.Warn("yahoo ending_date: no layout matched", "raw", s)
+	return nil
+}
+
 // ActiveListingInput is the input schema for `automation-lab/ebay-scraper`.
 // The actor accepts keyword searches and standard filters; it targets
 // ebay.com only (no per-marketplace routing in the actor itself), so
@@ -145,6 +205,10 @@ type UnifiedResult struct {
 	// MatchedQuery records which alias from the item's query list produced
 	// this row. Empty for URL-only items or rows from non-search sources.
 	MatchedQuery string
+	// EndsAt is the auction end time, if known. Auction-format eBay listings
+	// and Yahoo Auctions JP listings populate this; fixed-price listings
+	// and most Apify scraper outputs leave it nil.
+	EndsAt *time.Time
 }
 
 // Decode unmarshals a list of raw JSON items into UnifiedResult slices using
@@ -197,8 +261,10 @@ func Decode(items []json.RawMessage, source string) ([]UnifiedResult, error) {
 		}
 	case SourceYahooJP:
 		for _, raw := range items {
+			slog.Debug("yahoo raw item", "json", string(raw))
 			var r YahooAuctionsJPResult
 			if err := json.Unmarshal(raw, &r); err != nil {
+				slog.Debug("yahoo decode failed", "err", err, "json", string(raw))
 				continue
 			}
 			img := ""
@@ -213,6 +279,7 @@ func Decode(items []json.RawMessage, source string) ([]UnifiedResult, error) {
 				Store:    "yahoo-auctions-jp (via zenmarket)",
 				ImageURL: img,
 				Source:   source,
+				EndsAt:   parseYahooEndingDate(r.EndingDate),
 			})
 		}
 	case SourceMercariJP: