Auction end times, visual flair, and pre-launch cleanup

Auction handling:
- Capture itemEndDate from eBay Browse API and ending_date from ZenMarket
  (Yahoo JP); plumb through results.ends_at column. Permissive ZenMarket
  parser (multiple layouts, JST when offset missing).
- Per-row "Ends" countdown column + "Ending soon" banner on results pages,
  live-ticked by flair.js with urgent/critical tinting under 1h/5m.
- Backfill ends_at for known auctions when their URL reappears in a poll
  (dedup hit no longer drops the new end time).
- Hide ended auctions from result listings by default via
  ResultsQuery.ExcludeEnded; rows stay in the DB.

Visual flair:
- Glassy backdrop-blur v-cards with gradient-mask borders and hover-lift.
- htmx swap fade-in via transient .v-just-swapped class.
- Count-up animation on dashboard stats. All animations gated behind
  prefers-reduced-motion.

eBay condition + region filters (auctions-style scoping):
- items.condition and items.region columns; threaded through item form,
  CreateItem/UpdateItem, scheduler eBay plan input, and previewKey so
  cache invalidates when these change.
- ebay.SearchParams gains conditionIds and itemLocationCountry filters.

Run Now reload + countdown engine:
- Run Now now sets HX-Refresh: true (non-htmx fallback: 303 redirect) so
  the entire results view — best price, chart, badge, last polled —
  reflects the new poll, instead of swapping just one partial.

Pre-launch hardening (P1 set):
- auth.EqualizeLoginTiming on no-such-user branch.
- (*App).serverError centralizes 500s; replaces err.Error() leaks across
  results/settings/items/users/dashboard handlers.
- main.go server: ReadTimeout 30s / WriteTimeout 60s / IdleTimeout 120s
  alongside the existing ReadHeaderTimeout.
- noListFS wrapper blocks static directory listings.
- Credential fields in settings no longer render value=; blank submission
  preserves the saved value, with per-field "Saved in settings / Set in
  config.toml / Not set" status indicator.

Misc:
- -debug flag wires slog to LevelDebug; raw ZenMarket items logged for
  format diagnosis.
- /healthz public endpoint for reverse-proxy probes.
- deploy/veola.service systemd unit template (hardening flags, single
  ReadWritePaths=/var/lib/veola).
- handlers_test.go covers /healthz, setup-gate redirect, auth gate, and
  /login render with httptest + in-memory sqlite.
- best_price_currency on items; templates pick the right symbol per row.
- .gitignore now excludes *.log / veola-debug.log.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/handlers/items.go

@@ -93,6 +93,8 @@ func parseItemForm(r *http.Request) (models.Item, []string) {
 	}
 	it.Marketplaces = collectMarketplaces(r.PostForm["marketplace"], r.PostFormValue("marketplace_custom"))
 	it.ListingType = strings.TrimSpace(r.PostFormValue("listing_type"))
+	it.Condition = strings.TrimSpace(r.PostFormValue("condition"))
+	it.Region = strings.ToUpper(strings.TrimSpace(r.PostFormValue("region")))
 	it.ActorActive = strings.TrimSpace(r.PostFormValue("actor_active"))
 	it.ActorSold = strings.TrimSpace(r.PostFormValue("actor_sold"))
 	it.ActorPriceCompare = strings.TrimSpace(r.PostFormValue("actor_price_compare"))
@@ -253,6 +255,8 @@ func (a *App) runPreview(ctx context.Context, it models.Item) ([]apify.UnifiedRe
 		Marketplace: previewMarket,
 		ListingType: it.ListingType,
 		ActorIDs:    strings.Join(actorIDs, ","),
+		Condition:   it.Condition,
+		Region:      it.Region,
 		MaxResults:  30,
 	}
 	if cached, src, ok := a.Preview.Get(key); ok {
@@ -304,6 +308,8 @@ func formValuesFromItem(it models.Item, r *http.Request) templates.FormValues {
 		IncludeOutOfStock:   it.IncludeOutOfStock,
 		Marketplaces:        it.Marketplaces,
 		ListingType:         it.ListingType,
+		Condition:           it.Condition,
+		Region:              it.Region,
 		ActorActive:         it.ActorActive,
 		ActorSold:           it.ActorSold,
 		ActorPriceCompare:   it.ActorPriceCompare,
@@ -319,7 +325,7 @@ func (a *App) PostCreateItem(w http.ResponseWriter, r *http.Request) {
 	}
 	id, err := a.Store.CreateItem(r.Context(), &it)
 	if err != nil {
-		http.Error(w, "could not save item: "+err.Error(), http.StatusInternalServerError)
+		a.serverError(w, r, err)
 		return
 	}
 	it.ID = id
@@ -361,7 +367,7 @@ func (a *App) PostUpdateItem(w http.ResponseWriter, r *http.Request) {
 	updated.ID = id
 	updated.Active = existing.Active
 	if err := a.Store.UpdateItem(r.Context(), &updated); err != nil {
-		http.Error(w, err.Error(), http.StatusInternalServerError)
+		a.serverError(w, r, err)
 		return
 	}
 	a.Scheduler.SyncItem(updated)
@@ -377,7 +383,7 @@ func (a *App) PostToggleItem(w http.ResponseWriter, r *http.Request) {
 	}
 	it.Active = !it.Active
 	if err := a.Store.SetItemActive(r.Context(), id, it.Active); err != nil {
-		http.Error(w, err.Error(), http.StatusInternalServerError)
+		a.serverError(w, r, err)
 		return
 	}
 	a.Scheduler.SyncItem(*it)
@@ -387,7 +393,7 @@ func (a *App) PostToggleItem(w http.ResponseWriter, r *http.Request) {
 func (a *App) PostDeleteItem(w http.ResponseWriter, r *http.Request) {
 	id := intParam(r, "id")
 	if err := a.Store.DeleteItem(r.Context(), id); err != nil {
-		http.Error(w, err.Error(), http.StatusInternalServerError)
+		a.serverError(w, r, err)
 		return
 	}
 	a.Scheduler.RemoveItem(id)
@@ -410,31 +416,22 @@ func (a *App) PostRunItem(w http.ResponseWriter, r *http.Request) {
 	defer cancel()
 	a.Scheduler.RunPoll(ctx, *it)
 
-	// RunPoll writes best price, last_polled_at, and last_poll_error; re-fetch
-	// so the rendered partial shows the post-poll state.
-	fresh, err := a.Store.GetItem(r.Context(), id)
-	if err != nil || fresh == nil {
-		http.Error(w, "could not reload item after run", http.StatusInternalServerError)
+	// A partial swap (single row or just the results table) leaves the rest
+	// of the page — best-price card, price chart, "last polled" time, badge —
+	// looking stale, so the run reads as a no-op. Tell htmx to do a full
+	// reload so every derived view picks up the post-poll state.
+	if r.Header.Get("HX-Request") != "" {
+		w.Header().Set("HX-Refresh", "true")
+		w.WriteHeader(http.StatusNoContent)
 		return
 	}
 
-	// The results page asks for a refreshed listing table; the items list
-	// asks for a refreshed row. Both POST to this same endpoint.
+	// Non-htmx fallback: redirect back to the originating page.
+	target := "/items"
 	if r.PostFormValue("from") == "results" {
-		d, err := a.buildItemResultsData(r, fresh, 1, "found_desc")
-		if err != nil {
-			http.Error(w, err.Error(), http.StatusInternalServerError)
-			return
-		}
-		if fresh.LastPollError != "" {
-			d.RunError = "Run finished with errors: " + fresh.LastPollError
-		} else {
-			d.RunMsg = fmt.Sprintf("Run complete. Showing %d listing(s).", len(d.Results))
-		}
-		render(w, r, templates.ItemResultsTable(d))
-		return
+		target = fmt.Sprintf("/items/%d/results", id)
 	}
-	render(w, r, templates.ItemRow(*fresh, a.Auth.CSRFToken(r.Context())))
+	http.Redirect(w, r, target, http.StatusSeeOther)
 }
 
 func (a *App) GetItemError(w http.ResponseWriter, r *http.Request) {