dev -> main - add embedded web UI, monitoring endpoints and API hardening

[GIC-de]

Summary

This PR merges dev into main. It adds an embedded web UI, a set of new read-only REST endpoints that the UI uses, protections for the unauthenticated API, and reworked Debian packaging.

⚠️ Behavior changes

• The web UI is on by default. It is served on /. Disable it with -ui=false.
• File upload is on by default. The -upload flag now defaults to true. Disable it with -upload=false.
• The interfaces endpoint is on by default. GET /api/v1/interfaces can be disabled with -interfaces-api=false.
• The default bngblaster path changed from /usr/sbin/bngblaster to /usr/bin/bngblaster. Override it with -e.
• Relative stream_config paths must stay inside the instance folder. Absolute paths, for example files in home directories, are still used as-is.
• Cross-origin state-changing requests are rejected. The check uses Sec-Fetch-Site/Origin.
• Log output is split by level. Warn and above goes to stderr. Info, debug and trace go to stdout.

Note: The web UI, file upload and the interfaces endpoint are on by default only for the beta. These defaults may change before the final release, so pass the flags explicitly (-ui, -upload, -interfaces-api) if your setup depends on them.

✨ Features

Embedded web UI

• Plain HTML/CSS/JS single-page app, embedded with go:embed. It has no build step and no framework.
• Lists instances and handles their lifecycle (create, edit config, start, stop, delete).
• Edits instance config against the bngblaster JSON schema.
• Shows an overview with interface stats, including loss count and loss % (0.001% precision, red when > 0).
• Has views for streams, sessions, BGP, logs and files (download/upload).
• Progress bars.

New API endpoints

Method	Path	Description
GET	/api/v1/schema	bngblaster config JSON schema (path set with -schema)
GET	/api/v1/interfaces	Host network interfaces (behind -interfaces-api)
GET	/api/v1/instances/{name}/_overview	Aggregated instance overview
GET	/api/v1/instances/{name}/_streams	Paginated stream summary
GET	/api/v1/instances/{name}/_sessions	Paginated session summary
GET	/api/v1/instances/{name}/_logs	Instance log output
GET	/api/v1/instances/{name}/_files	List instance files
GET	/api/v1/instances/{name}/_files/{file_name}	Download an instance file
GET	/docs/	Embedded Swagger UI and OpenAPI definition

• Stream, session and overview results are cached per instance for a short time. Concurrent identical requests share one fetch, and the cache is invalidated on lifecycle changes.
• docs/swagger.yaml is extended to cover all new endpoints.

New flags

• -ui (default true)
• -interfaces-api (default true)
• -schema (default /usr/share/bngblaster/bngblaster-config.json)
• -allowed-hosts: comma-separated Host header allowlist against DNS rebinding. IP addresses and localhost are always allowed. An empty value allows any host.

🔒 Security hardening

• Cross-origin check for state-changing requests.
• -allowed-hosts Host header allowlist.
• Security headers and a Content Security Policy on every response.
• Bounded request bodies. Uploads larger than the free disk space are rejected.
• Uploads of controller-managed run files (run.pid, run.sock, …) are rejected, as are pids <= 1. This prevents killing arbitrary processes as root.
• Uploads and downloads are confined to the instance folder. File names are sanitized against path traversal.
• Audit log of the client address for requests and lifecycle changes.
• systemd unit sandboxing: ProtectSystem=full, ProtectHome=read-only, PrivateTmp, kernel/cgroup/clock/hostname protection, RestrictSUIDSGID, LockPersonality.

🐛 Fixes

• Graceful HTTP shutdown (30s timeout) lets in-flight requests and downloads finish. File transfers have no write deadline.
• Instance files are served with Cache-Control: no-cache, and config.json is fetched with no-store. The config editor no longer reopens a stale version.

📦 Packaging (deb / systemd)

• New /etc/default/rtbrick-bngblasterctrl with BNGBLASTERCTRL_OPTS to pass flags to the service.
• New logrotate config.
• Service state is kept on upgrade, and a postrm script is added. The package recommends bngblaster.
• The service is re-enabled after upgrading from ≤ 0.1.3. The old prerm stopped and disabled it.

🛠 Build / CI / maintenance

• Go upgraded from 1.25 to 1.27.1. testify bumped from 1.4.0 to 1.12.1.
• golangci-lint v2 config and a CI lint job (fails only on new issues). The linter is built from source for Go 1.27 compatibility.
• GitHub Actions bumped: checkout/setup-go v7, golangci-lint-action v9, goreleaser-action v7.
• CI builds an installable dev package with a goreleaser snapshot and uploads it as the bngblasterctrl-dev artifact. The version scheme is <next patch>~dev.<time>.<commit>, so the next release upgrades over it.
• Stream and session pagination share a generic summary handler (summary.go), and lint findings are fixed.
• Copyright updated to 2020-2026. CLAUDE.md added. README updated for the new flags, defaults and hardening.

🤖 Generated with Claude Code