LB buckets column + health cascade; VPP dump fix; maglevc strictness

SPA (cmd/frontend/web):
- New "lb buckets" column backed by a 1s-debounced GetVPPLBState
  fetch loop with leading+trailing edge coalesce.
- Per-frontend health icon (✅/⚠️/❗/‼️/❓) in the Zippy header,
  gated by a settling flag that suppresses ‼️ until the next lb-state
  reconciliation after a backend transition or weight change.
- In-place leaf merge on lb-state so stable bucket values (e.g. "0")
  don't retrigger the Flash animation on every refresh.
- Zippy cards remember open state in a cookie, default closed on
  fresh load; fixed-width frontend-title-name + reserved icon slot
  so headers line up across all cards.
- Clock-drift watchdog in sse.ts that forces a fresh EventSource on
  laptop-wake so the broker emits a resync instead of hanging on a
  dead half-open socket.

Frontend service (cmd/frontend):
- maglevClient.lbStateLoop, trigger on backend transitions +
  vpp-connect, best-effort fetch on refreshAll.
- Admin handlers explicitly wake the lb-state loop after lifecycle
  ops and set-weight (the latter emits no transition event on the
  maglevd side, so the WatchEvents path wouldn't have caught it).
- /favicon.ico served from embedded web/public IPng logo.

VPP integration:
- internal/vpp/lbstate.go: dumpASesForVIP drops Pfx from the dump
  request (setting it silently wipes IPv4 replies in the LB plugin)
  and filters results by prefix on the response side instead, which
  also demuxes multi-VIP-on-same-port cases correctly.

maglevc:
- Walk now returns the unconsumed token tail; dispatch and the
  question listener reject unknown commands with a targeted error
  instead of dumping the full command tree prefixed with garbage.
- On '?', echo the current line (including the '?') before the help
  list so the output reads like birdc.

Checker / prober:
- internal/checker: ±10% jitter on NextInterval so probes across
  restart don't all fire on the same tick.
- internal/prober: HTTP User-Agent now carries the build version
  and project URL.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/frontend/types.go

@@ -15,6 +15,18 @@ type StateSnapshot struct {
 	// from vpp-connect / vpp-disconnect / vpp-api-{send,recv} log
 	// events and re-seeded on every refreshAll tick.
 	VPPState string `json:"vpp_state,omitempty"`
+	// LBState is the most recent VPP LB plugin view of buckets-per-backend,
+	// keyed by frontend name → backend name → bucket count. nil when VPP is
+	// disconnected or no fetch has succeeded yet.
+	LBState *LBStateSnapshot `json:"lb_state,omitempty"`
+}
+
+// LBStateSnapshot is a per-(frontend, backend) view of VPP's bucket
+// allocation. The frontend collects this with GetVPPLBState and matches
+// VPP's VIP records back to maglev frontend/backend names so the SPA
+// never has to know about VPP-side prefixes or AS addresses.
+type LBStateSnapshot struct {
+	PerFrontend map[string]map[string]int32 `json:"per_frontend"`
 }
 
 // MaglevdInfo is the per-maglevd connection status record.
@@ -98,11 +110,19 @@ type VPPInfoSnapshot struct {
 // BrowserEvent is the wire shape sent over SSE to the browser.
 type BrowserEvent struct {
 	Maglevd  string          `json:"maglevd"`
-	Type     string          `json:"type"` // log|backend|frontend|maglevd-status|resync
+	Type     string          `json:"type"` // log|backend|frontend|maglevd-status|vpp-status|lb-state|resync
 	AtUnixNs int64           `json:"at_unix_ns"`
 	Payload  json.RawMessage `json:"payload"`
 }
 
+// LBStatePayload rides on a "lb-state" BrowserEvent and carries the
+// freshly-fetched bucket map. PerFrontend may be nil (or empty) to
+// signal "no LB state available" — the SPA renders such backends
+// with an em-dash in the buckets column.
+type LBStatePayload struct {
+	PerFrontend map[string]map[string]int32 `json:"per_frontend"`
+}
+
 // BackendEventPayload is what we ship inside BrowserEvent.Payload for
 // type == "backend".
 type BackendEventPayload struct {