feat(web): add category tabs, validation, and paste support

[danielewood]

Summary

• Category tabs: Replace Inspect/Verify tab navigation with unified category tabs (Leaf, Intermediate, Root, Keys) — certificates are organized by type with click-to-expand detail rows showing validation checks and metadata
• WASM validation: Add certkitValidateCert function that runs expiration, key strength, signature algorithm, and trust chain checks against the Mozilla root store — results displayed inline in expandable detail rows
• Concurrent AIA resolution: Parallelize AIA fetches with configurable concurrency (default 20, WASM uses 50) using a context-cancellable semaphore pattern
• Paste support: Ctrl+V / Cmd+V pastes PEM or certificate text directly into the drop zone without needing a file (1 MB limit)
• Hardening: Processing guard prevents concurrent operations, XSS escaping on dynamic content, panic fix for empty Organization slices, file-read error handling, reset recovery

Test plan

• go test -race ./... passes
• GOOS=js GOARCH=wasm go vet ./cmd/wasm/ && go build -o /dev/null ./cmd/wasm/
• cd web && npm test passes
• Manual: drop cert files, verify category tabs show correct grouping
• Manual: click a certificate row, verify validation checks expand inline
• Manual: paste a PEM certificate (Ctrl+V), verify it processes
• Manual: paste into the password input field, verify it does NOT trigger processing
• Manual: verify AIA progress bar during chain resolution

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR enhances the web UI with category-based certificate organization, browser-based validation using Mozilla root store, concurrent AIA resolution with progress tracking, and paste support for certificate data.

Changes:

• Replace tab-based navigation with category tabs (Leaf, Intermediate, Root, Keys) and click-to-expand validation details
• Add WASM validation function that performs expiration, key strength, signature, and trust chain checks
• Parallelize AIA fetches (default 20, WASM uses 50 concurrent requests) with progress reporting
• Enable Ctrl+V/Cmd+V paste support for certificate data (1 MB limit)

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
web/public/index.html	Adds category tab navigation, progress bar UI, removes old filter checkboxes, restructures table headers
web/public/app.js	Implements category tabs, paste handler, detail row expansion with validation, progress callbacks, processing guards
internal/certstore/aia.go	Adds concurrent AIA fetching with semaphore, progress callbacks, Mozilla root checks
cmd/wasm/validate.go	New validation function with expiration, key strength, signature, and trust chain checks
cmd/wasm/aia.go	Integrates progress callback to JavaScript via setTimeout
CHANGELOG.md	Documents new features with commit references

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 7 comments.

[claude]

test comment

[claude]

Removing test comment posted earlier.

[claude]

Code review

Found 4 issues: 1 bug and 3 CLAUDE.md violations. Inline comments follow in separate messages since the review API requires approval in this environment.

Bug (internal/certstore/aia.go:109): progressTotal overflow in multi-depth AIA resolution

progressTotal is computed once before the depth loop by counting only the certs currently in the store that satisfy needsResolution. But newly-fetched intermediates are added to the store during Phase 3 of each round and can themselves satisfy needsResolution in a subsequent round, causing them to be added to processed too.

Concrete trace with a leaf -> intermediate -> root chain where only the leaf was uploaded:

• Initial: progressTotal = 1 (only the leaf counts)
• Round 0: leaf fetches its intermediate, Phase 3 adds it to the store, leaf is marked processed -> OnProgress(1, 1) = 100%
• Round 1: the newly-added intermediate needs its issuer, gets processed -> OnProgress(2, 1) = 200%

The final tick at line 244 resets the bar to 100% at the end, but the mid-loop call with completed > total already causes progressFill.style.width = 200% in the browser. This is not a theoretical edge case -- it is the normal multi-depth resolution path.

Fix: recompute progressTotal at the start of each round (e.g. progressTotal += len(queue) before Phase 1), or cap the reported value with min(len(processed), progressTotal) in the OnProgress call.

[claude]

CLAUDE.md CTX-2 violation (cmd/wasm/validate.go:79): context discarded

runValidation accepts context.Context as its first parameter but immediately discards it. The caller at line 41 establishes a 30-second timeout that is never honored:

ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
defer cancel()
// ...
result, err := runValidation(ctx, globalStore, ski)  // ctx silently dropped inside

CTX-2 (MUST): Propagate non-nil ctx; honor Done/deadlines/timeouts.

If the user navigates away or the browser tab is closed, runValidation continues running to completion regardless of the timeout. The context should be propagated to its callees, or -- if propagation is genuinely impossible in the WASM context -- the parameter should be removed and the timeout enforced at a different boundary.

[claude]

CLAUDE.md CL-3 / CL-4 violation (CHANGELOG.md:12): commit refs do not exist in this repository

The refs d8b9759 and 837e5e8 used in lines 12-19 and the corresponding link definitions added at lines 576-577 do not match any commit in this PR or anywhere in the repository history. These appear to be stale SHAs from a previous branch iteration before a rebase or squash.

The actual PR commits are: 4e8b1a0, f544847, 607edcb, 2fb7a63, 3feac67, 33c9588, b9430db, eb372e0.

CL-3 (MUST): each entry must end with the commit ref that introduced the change. CL-4 (MUST): the link definition at the bottom must point to the actual commit. Update all five entries and both link definitions to the correct SHAs.

[claude]

CLAUDE.md T-9 violation (cmd/wasm/validate.go:131): certkit-specific policy logic has no tests

checkExpiration, checkKeyStrength, checkSignature, and checkTrustChain implement certkit certificate validation policy -- thresholds like RSA < 2048 = fail, MD5/SHA1 = fail/warn, and the expired-cert time-travel heuristic -- that are certkit-specific decisions, not thin stdlib wrappers. T-9 (MUST): Test certkit logic, not upstream behavior.

The //go:build js && wasm constraint prevents direct unit-testing of these functions. The standard remedy is to extract the pure-Go policy logic into a non-WASM internal package that go test ./... can reach, leaving only the thin WASM wrappers in cmd/wasm. The no-tests exemption in CLAUDE.md section 8 covers cmd/certkit specifically -- not cmd/wasm.