LB buckets column + health cascade; VPP dump fix; maglevc strictness

SPA (cmd/frontend/web):
- New "lb buckets" column backed by a 1s-debounced GetVPPLBState
  fetch loop with leading+trailing edge coalesce.
- Per-frontend health icon (✅/⚠️/❗/‼️/❓) in the Zippy header,
  gated by a settling flag that suppresses ‼️ until the next lb-state
  reconciliation after a backend transition or weight change.
- In-place leaf merge on lb-state so stable bucket values (e.g. "0")
  don't retrigger the Flash animation on every refresh.
- Zippy cards remember open state in a cookie, default closed on
  fresh load; fixed-width frontend-title-name + reserved icon slot
  so headers line up across all cards.
- Clock-drift watchdog in sse.ts that forces a fresh EventSource on
  laptop-wake so the broker emits a resync instead of hanging on a
  dead half-open socket.

Frontend service (cmd/frontend):
- maglevClient.lbStateLoop, trigger on backend transitions +
  vpp-connect, best-effort fetch on refreshAll.
- Admin handlers explicitly wake the lb-state loop after lifecycle
  ops and set-weight (the latter emits no transition event on the
  maglevd side, so the WatchEvents path wouldn't have caught it).
- /favicon.ico served from embedded web/public IPng logo.

VPP integration:
- internal/vpp/lbstate.go: dumpASesForVIP drops Pfx from the dump
  request (setting it silently wipes IPv4 replies in the LB plugin)
  and filters results by prefix on the response side instead, which
  also demuxes multi-VIP-on-same-port cases correctly.

maglevc:
- Walk now returns the unconsumed token tail; dispatch and the
  question listener reject unknown commands with a targeted error
  instead of dumping the full command tree prefixed with garbage.
- On '?', echo the current line (including the '?') before the help
  list so the output reads like birdc.

Checker / prober:
- internal/checker: ±10% jitter on NextInterval so probes across
  restart don't all fire on the same tick.
- internal/prober: HTTP User-Agent now carries the build version
  and project URL.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/frontend/web/src/api/sse.ts

@@ -2,6 +2,7 @@ import type {
   BackendEventPayload,
   BrowserEvent,
   FrontendEventPayload,
+  LBStatePayload,
   MaglevdStatusPayload,
   VPPStatusPayload,
 } from "../types";
@@ -9,6 +10,7 @@ import { fetchAllState } from "./rest";
 import {
   applyBackendTransition,
   applyFrontendTransition,
+  applyLBState,
   applyMaglevdStatus,
   applyVPPStatus,
   replaceAll,
@@ -19,10 +21,24 @@ import { pushEvent } from "../stores/events";
 // reconnects with the Last-Event-ID header set, which the Go broker uses
 // to replay events from its 30s ring buffer. A "resync" event tells us to
 // refetch full state and redraw.
-export function openEventStream(): EventSource {
-  const es = new EventSource("/view/api/events");
+//
+// On top of the browser's built-in reconnect we also run a clock-drift
+// watchdog: a setInterval that doesn't fire during OS suspend, so a tick
+// that arrives much later than expected almost always means the laptop
+// just came back from sleep. EventSource doesn't notice when its TCP
+// connection has been silently torn down during sleep (no FIN was
+// delivered, so readyState stays OPEN forever), so we force-reconnect
+// ourselves on a wake. The new connection sends no Last-Event-ID, which
+// makes the broker emit a "resync" event and the handler below refetches
+// full state.
+const SSE_WAKE_TICK_MS = 10_000;
+const SSE_WAKE_THRESHOLD_MS = 30_000;
 
-  es.onmessage = (msg) => {
+export function openEventStream(): void {
+  let es: EventSource | undefined;
+  let reconnecting = false;
+
+  const onMessage = (msg: MessageEvent) => {
     try {
       const ev = JSON.parse(msg.data) as BrowserEvent;
       dispatch(ev);
@@ -31,23 +47,60 @@ export function openEventStream(): EventSource {
     }
   };
 
-  // "resync" is emitted as a named event so we can listen for it
-  // without it going through the default onmessage dispatch.
-  es.addEventListener("resync", async () => {
+  const onResync = async () => {
     try {
       const snaps = await fetchAllState();
       replaceAll(snaps);
     } catch (err) {
       console.error("resync refetch failed", err);
     }
-  });
-
-  es.onerror = (err) => {
-    // EventSource handles reconnection on its own — just log.
-    console.debug("sse error, browser will reconnect", err);
   };
 
-  return es;
+  const connect = () => {
+    if (es) {
+      es.close();
+      es = undefined;
+    }
+    es = new EventSource("/view/api/events");
+    es.onmessage = onMessage;
+    es.addEventListener("resync", onResync);
+    es.onerror = (err) => {
+      // EventSource handles reconnection on its own — just log.
+      console.debug("sse error, browser will reconnect", err);
+    };
+  };
+
+  const reconnect = (reason: string) => {
+    // Coalesce multiple wake signals that fire within the same instant
+    // (e.g. clock-drift tick AND a future visibility hook). One brief
+    // window is enough; subsequent calls are no-ops.
+    if (reconnecting) return;
+    reconnecting = true;
+    console.info("sse reconnecting:", reason);
+    connect();
+    setTimeout(() => {
+      reconnecting = false;
+    }, 1000);
+  };
+
+  // Wake detector. The interval is short enough (10s) to catch even
+  // brief naps, the threshold (30s) is well above the interval + JS
+  // jitter so a clean wake reads unambiguously, and we never trigger
+  // on normal background-tab throttling because that doesn't usually
+  // pause setInterval for 30+ seconds at a time. If a future Chrome
+  // policy starts throttling that aggressively, the worst case is one
+  // extra reconnect every few minutes — still cheap.
+  let lastTick = Date.now();
+  setInterval(() => {
+    const now = Date.now();
+    const elapsed = now - lastTick;
+    lastTick = now;
+    if (elapsed > SSE_WAKE_THRESHOLD_MS) {
+      reconnect(`wake detected (${Math.round(elapsed / 1000)}s gap)`);
+    }
+  }, SSE_WAKE_TICK_MS);
+
+  connect();
 }
 
 function dispatch(ev: BrowserEvent) {
@@ -68,6 +121,9 @@ function dispatch(ev: BrowserEvent) {
     case "vpp-status":
       applyVPPStatus(ev.maglevd, (ev.payload as VPPStatusPayload).state);
       break;
+    case "lb-state":
+      applyLBState(ev.maglevd, ev.payload as LBStatePayload);
+      break;
     case "log":
       // Log events are displayed in the DebugPanel but no longer
       // mutate the state tree. The previous vpp-lb-sync-as-*