Auction end times, visual flair, and pre-launch cleanup

Auction handling:
- Capture itemEndDate from eBay Browse API and ending_date from ZenMarket
  (Yahoo JP); plumb through results.ends_at column. Permissive ZenMarket
  parser (multiple layouts, JST when offset missing).
- Per-row "Ends" countdown column + "Ending soon" banner on results pages,
  live-ticked by flair.js with urgent/critical tinting under 1h/5m.
- Backfill ends_at for known auctions when their URL reappears in a poll
  (dedup hit no longer drops the new end time).
- Hide ended auctions from result listings by default via
  ResultsQuery.ExcludeEnded; rows stay in the DB.

Visual flair:
- Glassy backdrop-blur v-cards with gradient-mask borders and hover-lift.
- htmx swap fade-in via transient .v-just-swapped class.
- Count-up animation on dashboard stats. All animations gated behind
  prefers-reduced-motion.

eBay condition + region filters (auctions-style scoping):
- items.condition and items.region columns; threaded through item form,
  CreateItem/UpdateItem, scheduler eBay plan input, and previewKey so
  cache invalidates when these change.
- ebay.SearchParams gains conditionIds and itemLocationCountry filters.

Run Now reload + countdown engine:
- Run Now now sets HX-Refresh: true (non-htmx fallback: 303 redirect) so
  the entire results view — best price, chart, badge, last polled —
  reflects the new poll, instead of swapping just one partial.

Pre-launch hardening (P1 set):
- auth.EqualizeLoginTiming on no-such-user branch.
- (*App).serverError centralizes 500s; replaces err.Error() leaks across
  results/settings/items/users/dashboard handlers.
- main.go server: ReadTimeout 30s / WriteTimeout 60s / IdleTimeout 120s
  alongside the existing ReadHeaderTimeout.
- noListFS wrapper blocks static directory listings.
- Credential fields in settings no longer render value=; blank submission
  preserves the saved value, with per-field "Saved in settings / Set in
  config.toml / Not set" status indicator.

Misc:
- -debug flag wires slog to LevelDebug; raw ZenMarket items logged for
  format diagnosis.
- /healthz public endpoint for reverse-proxy probes.
- deploy/veola.service systemd unit template (hardening flags, single
  ReadWritePaths=/var/lib/veola).
- handlers_test.go covers /healthz, setup-gate redirect, auth gate, and
  /login render with httptest + in-memory sqlite.
- best_price_currency on items; templates pick the right symbol per row.
- .gitignore now excludes *.log / veola-debug.log.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

templates/settings.templ

@@ -8,8 +8,12 @@ import (
 
 type SettingsData struct {
 	Page
-	Values         map[string]string
-	IsAdmin        bool
+	Values map[string]string
+	// CredentialStatus maps each secret settings key to a human-readable
+	// status ("Saved in settings", "Set in config.toml", "Not set"). Secret
+	// values are never rendered into the form itself.
+	CredentialStatus map[string]string
+	IsAdmin          bool
 	Users          []models.User
 	TestNtfyOK     string
 	TestApifyOK    string
@@ -28,6 +32,16 @@ func (d SettingsData) EbayLimitReached() bool {
 	return d.EbayDailyLimit > 0 && d.EbayUsedToday >= d.EbayDailyLimit
 }
 
+// credStatus renders the "Saved in settings / Set in config.toml / Not set"
+// indicator for a secret field without ever printing the secret itself.
+templ credStatus(d SettingsData, key string) {
+	if s := d.CredentialStatus[key]; s != "" {
+		<div class="v-muted text-xs mt-1">
+			Status: { s }
+		</div>
+	}
+}
+
 templ settingsBody(d SettingsData) {
 	<div class="space-y-8 max-w-3xl">
 		<h1 class="text-3xl font-semibold">Settings</h1>
@@ -38,15 +52,18 @@ templ settingsBody(d SettingsData) {
 				@CSRFInput(d.CSRFToken)
 				<div>
 					<label class="v-label">Apify API Key</label>
-					<input class="v-input font-mono" type="password" name="apify_api_key" value={ d.Values["apify_api_key"] }/>
+					<input class="v-input font-mono" type="password" name="apify_api_key" autocomplete="off" placeholder="leave blank to keep current value"/>
+					@credStatus(d, "apify_api_key")
 				</div>
 				<div class="border-t border-white/10 pt-4">
 					<label class="v-label">eBay App ID (Client ID)</label>
-					<input class="v-input font-mono" type="password" name="ebay_client_id" value={ d.Values["ebay_client_id"] } placeholder="used for eBay marketplaces instead of Apify"/>
+					<input class="v-input font-mono" type="password" name="ebay_client_id" autocomplete="off" placeholder="used for eBay marketplaces instead of Apify"/>
+					@credStatus(d, "ebay_client_id")
 				</div>
 				<div>
 					<label class="v-label">eBay Cert ID (Client Secret)</label>
-					<input class="v-input font-mono" type="password" name="ebay_client_secret" value={ d.Values["ebay_client_secret"] }/>
+					<input class="v-input font-mono" type="password" name="ebay_client_secret" autocomplete="off" placeholder="leave blank to keep current value"/>
+					@credStatus(d, "ebay_client_secret")
 				</div>
 				<div>
 					<label class="v-label">eBay Daily Call Limit</label>
@@ -73,7 +90,8 @@ templ settingsBody(d SettingsData) {
 				</div>
 				<div>
 					<label class="v-label">Ntfy Token</label>
-					<input class="v-input font-mono" type="password" name="ntfy_token" value={ d.Values["ntfy_token"] } placeholder="tk_... (leave blank if ntfy is unauthenticated)"/>
+					<input class="v-input font-mono" type="password" name="ntfy_token" autocomplete="off" placeholder="tk_... (leave blank to keep current value)"/>
+					@credStatus(d, "ntfy_token")
 				</div>
 				<div>
 					<label class="v-label">Global Poll Interval (minutes)</label>