feat(web): Overview/Tables/Beads tab bar + full issue fields on beads detail

Give every database page a consistent three-tab bar — Overview, Tables,
then the applicable views (Beads) — in that order. Previously the bar only
carried [views, Tables] and the Overview page marked Tables active, so there
was no way to tell you were on the overview. viewtabs now takes an explicit
Current sentinel ("overview" | "tables" | view slug) and the tree/table row
pages render the bar too (handlers compute applicable views for the ref).

Surface the issue fields the beads detail pane was dropping. The closure
reason (close_reason) recorded by `bd close -r` was never shown; auditing
against bd's own field set also turned up estimated_minutes, external_ref,
spec_id, and started_at. All render conditionally, so issues that don't set
them stay uncluttered.

feat: auto-provision companion Dolt DBs from git.sr.ht pushes

Add a service-to-service path so pushing a git.sr.ht repo creates a matching
Dolt database at ~owner/name, ready before the user's first `dolt push`.

- web: POST /internal/repos, guarded by internal-IP + network-key `Internal`
  auth (not the browser cookie/CSRF). Resolves/mirrors the owner via
  auth.LookupUser, then CreateRepo + InitStore, rolling back the row if the
  store init fails. Idempotent: an existing companion returns 200, a fresh one
  201 — safe to call on every push.
- cmd/dolt-git-hook: the git.sr.ht post-update-script. Delegates every hook
  stage to the stock /usr/bin/git.sr.ht-update-hook unchanged (argv[0], stdin,
  env, exit code preserved; fail-closed if the delegate is missing), then on
  post-update POSTs the companion create and prints a one-time clone notice.
  Best-effort: never fails a push, degrades to a warning on any misconfig.

Tests cover the endpoint (provision/idempotent/rollback/bad-input) and the hook
(signed request round-trips through the guard's decryption, notice only on 201).

test(gozstd-purego): expand shim coverage (interop, concurrency, edges)

Add to the pure-Go zstd shim's suite: reverse interop (shim output
decoded by the libzstd `zstd` CLI, plain and with a dictionary); the
dst-append contract for all four Compress/Decompress[Dict] funcs (dolt
passes non-empty buffers); edge cases (empty, one-byte, incompressible
random, 4 MiB random, large text); race-clean concurrency over the shared
plain coders and a shared DDict; and error paths (garbage input errors,
empty input is a documented benign no-op, wrong-dictionary decode errors
rather than returning wrong bytes). All pass under -race.

build: pure-Go (CGO_ENABLED=0) build via a klauspost-backed gozstd shim

dolthub/dolt/go pulls in two hard cgo dependencies — go-icu-regex (SQL
REGEXP) and gozstd (NBS zstd compression) — which forced a C toolchain +
ICU headers on every build. Both are now avoided so the default build is
pure Go and statically linkable:

- ICU: build with `-tags gms_pure_go`, selecting go-mysql-server's stdlib
  regexp fallback. Safe because this service never runs the SQL engine
  (it serves bare NBS stores and browses read-only), so it never
  evaluates SQL REGEXP.
- zstd: `replace github.com/dolthub/gozstd => ./third_party/gozstd-purego`,
  a pure-Go drop-in over klauspost/compress/zstd (already in the graph).
  It reproduces the nine gozstd symbols dolt references. dolt is
  unmodified.

dolt uses gozstd only in its NBS archive subsystem; this binary hits only
the decompress side at runtime (archive dictionary TRAINING is gc/
archive-writer code we never run — the shim implements it over klauspost
but panics on the trainer errors that only that off-path use could
trigger). zstd frames and dictionaries are standard-format, so
libzstd-authored archives decode correctly; the shim's tests prove this
by decoding plain and dictionary-compressed frames produced by the zstd
CLI (libzstd).

The Makefile now defaults to CGO_ENABLED=0 + -tags gms_pure_go (override
with `make CGO_ENABLED=1 GO_TAGS=` for the cgo variant). Verified:
CGO_ENABLED=0 build of ./..., all unit tests, the real-dolt-CLI
integration + spike suites, and the shim's libzstd-interop tests, all
green with no cgo.

style(web): restyle the beads parade in the todo.sr.ht idiom

The board still read as a rounded-card kanban from another app. Re-skin
every surface in sourcehut's own issue-tracker language (todo.sr.ht):
flat and square — no border-radius, no shadows, no tints — hairline gray
borders, monospace ids, striped-on-hover rows instead of cards, and
squared bordered labels (the sourcehut .label: 1px border, no radius).
The summary becomes a flat hairline strip and each lane a squared column
with a 2px accent cap. The Mardi Gras hues survive only as small square
swatches and the lane cap, never as fills, so the view looks like a
native sourcehut tracker in both the light and dark themes. Verified via
a headless light/dark render. Test asserts the renamed summary class.

fix(web): make the beads view inherit the SourceHut theme

The beads board shipped its own Mardi Gras palette — a purple→green
marquee gradient and saturated solid lane fills — that clashed with
SourceHut's flat, utilitarian dark theme, and the detail pane's field
labels were a hardcoded dark purple with no dark-mode override, leaving
"Created by / Owner / Description" unreadable on the dark background.

Drive everything from CSS variables that mirror core.sr.ht's Bootstrap
palette for both the light default and the prefers-color-scheme: dark
variant sourcehut ships (the same media query it uses), so the view
inherits the host theme instead of fighting it. Lane hues become muted
Mardi Gras accents (gold/green/violet/gray) used only as thin borders and
low-alpha tints — never as body text — so contrast holds on either theme.
The marquee is now a flat stat row, lanes an understated panel with an
accent underline, and detail labels a readable muted caption. Verified
light and dark via a headless render.

feat(web): Mardi Gras beads view

Render a beads (bd) issue database as a Mardi Gras parade board: four
lanes — Rolling (in progress), Lined Up (open & ready), Stalled (open &
blocked), Past Stand (done) — plus a marquee of per-lane counts. Cards
show id/title/type/priority/assignee/labels and blocked-by/blocks counts;
an issue-detail pane (?issue=<id>) shows the full issue with its
dependency edges in both directions and its comments thread.

Fingerprints on the issues + dependencies tables and reads everything
through the browse layer (column-name-keyed, so column order is
irrelevant), capped at 2000 rows/table. Status is bucketed via
custom_statuses with name heuristics as a fallback; "blocked" means
is_blocked or an open blocking dependency. Plugs into the view registry
via init()+RegisterView with no framework edits. Purple/gold/green
palette scoped in the template (no scss rebuild needed).

feat(web): pluggable alternative-view registry for repositories

A repository can now expose specialized, read-only "views" chosen by the
shape of its tables, while the generic table browser stays available as a
fallback. A View fingerprints the tables (Applies), builds a model from
the browse layer (Build), and renders its own template; views register at
init time via RegisterView and are dispatched by slug at
/~user/db/view/{slug}. The overview shows a tab per applicable view.

The template loader parses each registered view's template with the
shared chrome, so a new view plugs in by adding two files (its .go with
init()+RegisterView and its .html) plus nothing else — no edits to the
registry, router, loader, or handlers. Build receives the request query
values so a view can offer sub-modes (e.g. a detail pane). No SQL engine
is involved; views read through the existing BrowseSession surface.

feat(remoteapi): auto-create databases on first push to own namespace

Push-to-create: an authenticated, non-suspended caller pushing (or
cloning) an unknown repo under their OWN namespace has it transparently
created — a PRIVATE repository row plus a genuinely empty on-disk NBS
store — then proceeds through the normal ACL check as the owner. Any
other case (anonymous, suspended, another user's namespace, invalid
name) still returns NotFound, so a stranger's namespace is never leaked
and nothing is created.

storage.InitEmptyStore creates the store WITHOUT WriteEmptyRepo: an
"Initialize data repository" commit would make the client's first push a
non-fast-forward and be rejected. An empty store (root = empty hash) lets
the initial push land as the repo's first history. The interceptor
auto-create is race-safe (ErrNameTaken re-fetch) and rolls the row back
if the store cannot be created.

Proven end-to-end (integration): a real `dolt push` to a new name
auto-creates PRIVATE + fast-forwards + re-clones; a foreign-namespace
push is denied with no row created. All prior clone/push/ACL scenarios
still pass.

doltsrht: pass full os.Args to server.New so -b binds the web listener

getopt skips argv[0] as the program name, so os.Args[1:] made it swallow the
first real flag (-b) and silently fall back to defaultWebAddr (localhost),
leaving the web UI unreachable from Traefik. Match compare/upstream: pass os.Args.

rename module to sourcecraft.dev/bigbes/sr-ht-dolt; depend on sourcecraft sr-ht-core

build: source core-go from the instance fork

Replace git.sr.ht/~sircmpwn/core-go with git.srht.bigb.es/~bigbes/core-go
at c2c2f38 (upstream fdb3662 + newer upstream commits + the phoebe-lab S3
UnsignedPayload patch) - the code production actually runs. Requires
GOPRIVATE=git.srht.bigb.es to fetch. Full suite re-verified including the
remotesapi integration scenarios.

docs: add design spec

Architecture plan the v1 implementation followed: verified upstream
facts, schema, access matrix, remotesapi/auth design, browse subsystem,
config + nginx wiring, phase breakdown, and the post-deploy
verification script.

cmd: doltsrht and doltsrht-migrate binaries, module tidy

web: router, handlers, and sourcehut chrome

Chi route table per plan, SourceHut chrome port (nav/layout from
core.sr.ht Bootstrap structure), dual-flow clone box, dolt-key
association page with hash-fragment prefill, same-origin CSRF checks.
Handlers depend on small injected interfaces (StoreManager, RepoStore,
BrowseOpener, UserResolver) with production adapters included.

remoteapi: authz interceptors, remotesrv assembly, credentials service

browse: read-only doltdb browsing over bare stores

Read-only web-browsing data layer over bare NBS chunk stores, the only
package that reaches into version-fragile dolthub/dolt internals (nbs,
prolly, durable, diff), kept isolated so a module bump re-verifies here.

- open.go: Open/Close per request. Builds the DoltDB from a single
  nbs.NewLocalStore via doltdb.DoltDBFromCS instead of doltdb.LoadDoltDB:
  LoadDoltDB's GenerationalNBS wrapper panics on Close over our bare
  stores in the pinned version (onHeapTableIndex ref count < 0), even on
  a plain open-then-close. The single-store path closes cleanly, gives a
  fresh manifest per request, and is safe alongside the push writer.
- log.go: Branches (+ DefaultBranch pick), Log with topological walk,
  count+start-hash pagination, and commit metadata.
- tables.go: Tables (schema + cheap row count) and Rows via
  durable.ProllyMapFromIndex + prolly IterOrdinalRange, rendered through
  the tuple descriptors; NULLs, binary/out-of-band values and exotic
  encodings degrade to printable placeholders and never panic.
- diff.go: CommitSummary vs first parent (empty root for the initial
  commit) with exact added/removed/modified row counts from
  diff.StatForTableDelta.
- tests: fixture built the production way (WriteEmptyRepo bare store, CLI
  clone/commit/push over a file:// remote); covers branches, log
  pagination/topo order, tables/schema, row pagination incl. empty table,
  commit summaries across the add/insert/modify chain and the initial
  commit, and nonexistent ref/table errors.

authn: cookie, PAT, and dolt-JWT caller resolution

Add the authn package resolving the SourceHut caller across dolt.sr.ht's
three auth flows, producing core-go *auth.AuthContext values mapped onto the
pure core.Caller domain type:

- ctx.go: WithCaller/CallerFromContext (nil for anonymous, never panics) and
  AsCoreCaller (maps UserType, derives Suspended).
- cookie.go: OptionalCookieMiddleware, the never-rejecting unified-login
  cookie reader (fernet decrypt -> {name} -> LookupUser); any failure degrades
  to anonymous so public browsing keeps working.
- token.go: ResolveBasic, the meta personal-access-token trio (offline
  DecodeBearerToken -> username match -> LookupUser + revocation) with a 60s
  positive cache keyed by sha512(password); TokenGrantsAllow gates
  dolt.sr.ht/repos RO/RW grants (empty grants pass).
- jwt.go: ResolveDoltJWT, EdDSA JWS verification for dolt keypair auth (kid ->
  KeyStore pubkey, alg=EdDSA, aud/exp/sub checked, iss ignored), reusing
  dolt's creds.PubKeyToKIDStr for the kid<->pubkey integrity check.
- grpc.go: ResolveGRPCAuth dispatching Basic/Bearer/anonymous.

Meta lookup + revocation sit behind the MetaBackend interface and JWT keys
behind the KeyStore interface (implemented later by db/), so tests forge
cookies (fernet), PATs (BearerToken.Encode) and real Ed25519 JWTs against
in-memory stubs with no network or Postgres.

db: postgres layer for repos, ACLs, dolt keys

Store wraps a Querier (*sql.DB/*sql.Tx/*sql.Conn); context-first methods, FromContext for core-go middleware, WithTx for the create-repo transaction. Repo CRUD + listing-visibility rules, effective-access/ACL upsert, dolt_key CRUD with typed ErrNotFound/ErrNameTaken/ErrKeyExists. Tests gated on DOLTSRHT_TEST_PG: per-run scratch schema + schema.sql, CRUD/visibility/effective-access cases; skip when unset.

storage: bare store init/delete and remotesrv DBCache

InitStore writes a bare NBS store (LoadDoltDB Format_DOLT + WriteEmptyRepo)
with partial-failure cleanup; DeleteStore guards against paths escaping the
configured repos root; RepoDiskPath lays out <root>/~<owner>/<name>.

Cache implements remotesrv.DBCache over an injected RepoLookup (no db import,
no push-to-create): Get resolves via core.ParseRepoPath, memoizes one
nbs.NewLocalStore per disk path, never creates directories; Evict/Close for
delete and shutdown. Package doc records the LocalFilesysWithWorkingDir
sealed-URL requirement proven by the Phase-0 spike.

Unit tests cover store validity (reopen, main branch, initial commit),
partial-failure cleanup, root-escape guard, and cache hit/miss/memoize/evict.
Spike test untouched and still green.