Auction end times, visual flair, and pre-launch cleanup

Auction handling:
- Capture itemEndDate from eBay Browse API and ending_date from ZenMarket
  (Yahoo JP); plumb through results.ends_at column. Permissive ZenMarket
  parser (multiple layouts, JST when offset missing).
- Per-row "Ends" countdown column + "Ending soon" banner on results pages,
  live-ticked by flair.js with urgent/critical tinting under 1h/5m.
- Backfill ends_at for known auctions when their URL reappears in a poll
  (dedup hit no longer drops the new end time).
- Hide ended auctions from result listings by default via
  ResultsQuery.ExcludeEnded; rows stay in the DB.

Visual flair:
- Glassy backdrop-blur v-cards with gradient-mask borders and hover-lift.
- htmx swap fade-in via transient .v-just-swapped class.
- Count-up animation on dashboard stats. All animations gated behind
  prefers-reduced-motion.

eBay condition + region filters (auctions-style scoping):
- items.condition and items.region columns; threaded through item form,
  CreateItem/UpdateItem, scheduler eBay plan input, and previewKey so
  cache invalidates when these change.
- ebay.SearchParams gains conditionIds and itemLocationCountry filters.

Run Now reload + countdown engine:
- Run Now now sets HX-Refresh: true (non-htmx fallback: 303 redirect) so
  the entire results view — best price, chart, badge, last polled —
  reflects the new poll, instead of swapping just one partial.

Pre-launch hardening (P1 set):
- auth.EqualizeLoginTiming on no-such-user branch.
- (*App).serverError centralizes 500s; replaces err.Error() leaks across
  results/settings/items/users/dashboard handlers.
- main.go server: ReadTimeout 30s / WriteTimeout 60s / IdleTimeout 120s
  alongside the existing ReadHeaderTimeout.
- noListFS wrapper blocks static directory listings.
- Credential fields in settings no longer render value=; blank submission
  preserves the saved value, with per-field "Saved in settings / Set in
  config.toml / Not set" status indicator.

Misc:
- -debug flag wires slog to LevelDebug; raw ZenMarket items logged for
  format diagnosis.
- /healthz public endpoint for reverse-proxy probes.
- deploy/veola.service systemd unit template (hardening flags, single
  ReadWritePaths=/var/lib/veola).
- handlers_test.go covers /healthz, setup-gate redirect, auth gate, and
  /login render with httptest + in-memory sqlite.
- best_price_currency on items; templates pick the right symbol per row.
- .gitignore now excludes *.log / veola-debug.log.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/ebay/client.go

@@ -149,6 +149,8 @@ type browseItemSummary struct {
 	Seller struct {
 		Username string `json:"username"`
 	} `json:"seller"`
+	// itemEndDate is present only on auction-format listings.
+	ItemEndDate string `json:"itemEndDate"`
 }
 
 // Search runs one item_summary/search call and returns normalized listings.
@@ -174,8 +176,20 @@ func (c *Client) Search(ctx context.Context, p SearchParams) ([]Listing, error)
 	q := url.Values{}
 	q.Set("q", query)
 	q.Set("limit", strconv.Itoa(limit))
+	// The Browse API "filter" parameter takes a comma-separated list of
+	// filter clauses; assemble whichever ones the caller requested.
+	var filters []string
 	if f := buyingOptionsFilter(p.ListingType); f != "" {
-		q.Set("filter", f)
+		filters = append(filters, f)
+	}
+	if f := conditionIDsFilter(p.Condition); f != "" {
+		filters = append(filters, f)
+	}
+	if f := itemLocationFilter(p.Region); f != "" {
+		filters = append(filters, f)
+	}
+	if len(filters) > 0 {
+		q.Set("filter", strings.Join(filters, ","))
 	}
 	reqURL := c.ends.browse + "/item_summary/search?" + q.Encode()
 
@@ -214,6 +228,12 @@ func (c *Client) Search(ctx context.Context, p SearchParams) ([]Listing, error)
 		if s.Seller.Username != "" {
 			store = "ebay (" + s.Seller.Username + ")"
 		}
+		var endsAt *time.Time
+		if s.ItemEndDate != "" {
+			if t, err := time.Parse(time.RFC3339, s.ItemEndDate); err == nil {
+				endsAt = &t
+			}
+		}
 		out = append(out, Listing{
 			Title:    s.Title,
 			Price:    price,
@@ -221,6 +241,7 @@ func (c *Client) Search(ctx context.Context, p SearchParams) ([]Listing, error)
 			URL:      s.ItemWebURL,
 			Store:    store,
 			ImageURL: img,
+			EndsAt:   endsAt,
 		})
 	}
 	return out, nil

internal/ebay/ebay_test.go

@@ -43,3 +43,35 @@ func TestBuyingOptionsFilter(t *testing.T) {
 		}
 	}
 }
+
+func TestConditionIDsFilter(t *testing.T) {
+	cases := map[string]string{
+		"":            "",
+		"anything":    "",
+		"new":         "conditionIds:{1000|1500}",
+		"NEW":         "conditionIds:{1000|1500}",
+		" used ":      "conditionIds:{3000}",
+		"refurbished": "conditionIds:{2000|2010|2020|2030|2500}",
+		"parts":       "conditionIds:{7000}",
+	}
+	for in, want := range cases {
+		if got := conditionIDsFilter(in); got != want {
+			t.Errorf("conditionIDsFilter(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestItemLocationFilter(t *testing.T) {
+	cases := map[string]string{
+		"":     "",
+		"  ":   "",
+		"us":   "itemLocationCountry:US",
+		"GB":   "itemLocationCountry:GB",
+		" jp ": "itemLocationCountry:JP",
+	}
+	for in, want := range cases {
+		if got := itemLocationFilter(in); got != want {
+			t.Errorf("itemLocationFilter(%q) = %q, want %q", in, got, want)
+		}
+	}
+}

internal/ebay/types.go

@@ -1,6 +1,9 @@
 package ebay
 
-import "strings"
+import (
+	"strings"
+	"time"
+)
 
 // SearchParams is the input to a single Browse API item_summary/search call.
 // It is provider-specific and is carried as the opaque input payload of a
@@ -14,6 +17,14 @@ type SearchParams struct {
 	// ListingType is Veola's vocabulary ("all", "bin"/"buy_it_now",
 	// "auction"); it is mapped to a buyingOptions filter.
 	ListingType string
+	// Condition is Veola's condition vocabulary ("new", "used",
+	// "refurbished", "parts"); it is mapped to a conditionIds filter. Empty
+	// means no condition filter.
+	Condition string
+	// Region is an ISO 3166-1 alpha-2 country code constraining item
+	// location (mapped to the itemLocationCountry filter). Empty means no
+	// location filter.
+	Region string
 	// Limit caps the number of results requested (Browse API max is 200).
 	Limit int
 }
@@ -28,6 +39,10 @@ type Listing struct {
 	URL      string
 	Store    string
 	ImageURL string
+	// EndsAt is the auction end time as reported by the Browse API
+	// (itemEndDate). Nil for fixed-price ("Buy It Now") listings, which
+	// don't have one.
+	EndsAt *time.Time
 }
 
 // MarketplaceID maps a Veola marketplace string (e.g. "ebay.com",
@@ -92,3 +107,34 @@ func buyingOptionsFilter(listingType string) string {
 		return ""
 	}
 }
+
+// conditionIDsFilter maps Veola's condition vocabulary to a Browse API
+// "conditionIds" filter clause. Each Veola value expands to the set of eBay
+// condition IDs that belong to it (e.g. "new" covers both brand-new and
+// new-other). An empty or unknown value yields no filter.
+func conditionIDsFilter(condition string) string {
+	var ids string
+	switch strings.ToLower(strings.TrimSpace(condition)) {
+	case "new":
+		ids = "1000|1500"
+	case "used":
+		ids = "3000"
+	case "refurbished":
+		ids = "2000|2010|2020|2030|2500"
+	case "parts":
+		ids = "7000"
+	default:
+		return ""
+	}
+	return "conditionIds:{" + ids + "}"
+}
+
+// itemLocationFilter maps an ISO 3166-1 alpha-2 country code to a Browse API
+// "itemLocationCountry" filter clause. An empty value yields no filter.
+func itemLocationFilter(region string) string {
+	r := strings.ToUpper(strings.TrimSpace(region))
+	if r == "" {
+		return ""
+	}
+	return "itemLocationCountry:" + r
+}