remove distribution from hold, add vulnerability scanning in appview.

1. Removing distribution/distribution from the Hold Service (biggest change)
  The hold service previously used distribution's StorageDriver interface for all blob operations. This replaces it with direct AWS SDK v2 calls through ATCR's own pkg/s3.S3Service:
  - New S3Service methods: Stat(), PutBytes(), Move(), Delete(), WalkBlobs(), ListPrefix() added to pkg/s3/types.go
  - Pull zone fix: Presigned URLs are now generated against the real S3 endpoint, then the host is swapped to the CDN URL post-signing (previously the CDN URL was set as the endpoint, which
  broke SigV4 signatures)
  - All hold subsystems migrated: GC, OCI uploads, XRPC handlers, profile uploads, scan broadcaster, manifest posts — all now use *s3.S3Service instead of storagedriver.StorageDriver
  - Config simplified: Removed configuration.Storage type and buildStorageConfigFromFields(); replaced with a simple S3Params() method
  - Mock expanded: MockS3Client gains an in-memory object store + 5 new methods, replacing duplicate mockStorageDriver implementations in tests (~160 lines deleted from each test file)
2. Vulnerability Scan UI in AppView (new feature)
  Displays scan results from the hold's PDS on the repository page:
  - New lexicon: io/atcr/hold/scan.json with vulnReportBlob field for storing full Grype reports
  - Two new HTMX endpoints: /api/scan-result (badge) and /api/vuln-details (modal with CVE table)
  - New templates: vuln-badge.html (severity count chips) and vuln-details.html (full CVE table with NVD/GHSA links)
  - Repository page: Lazy-loads scan badges per manifest via HTMX
  - Tests: ~590 lines of test coverage for both handlers
3. S3 Diagnostic Tool
  New cmd/s3-test/main.go (418 lines) — tests S3 connectivity with both SDK v1 and v2, including presigned URL generation, pull zone host swapping, and verbose signing debug output.
4. Deployment Tooling
  - New syncServiceUnit() for comparing/updating systemd units on servers
  - Update command now syncs config keys (adds missing keys from template) and service units with daemon-reload
5. DB Migration
  0011_fix_captain_successor_column.yaml — rebuilds hold_captain_records to add the successor column that was missed in a previous migration.
6. Documentation
  - APPVIEW-UI-FUTURE.md rewritten as a status-tracked feature inventory
  - DISTRIBUTION.md renamed to CREDENTIAL_HELPER.md
  - New REMOVING_DISTRIBUTION.md — 480-line analysis of fully removing distribution from the appview side
7. go.mod
  aws-sdk-go v1 moved from indirect to direct (needed by cmd/s3-test).

deploy/upcloud/cloudinit.go

@@ -192,6 +192,39 @@ func generateCloudInit(p cloudInitParams) (string, error) {
 	return buf.String(), nil
 }
 
+// syncServiceUnit compares a rendered systemd service unit against what's on
+// the server. If they differ, it writes the new unit file. Returns true if the
+// unit was updated (caller should daemon-reload before restart).
+func syncServiceUnit(name, ip, serviceName, renderedUnit string) (bool, error) {
+	unitPath := "/etc/systemd/system/" + serviceName + ".service"
+
+	remote, err := runSSH(ip, fmt.Sprintf("cat %s 2>/dev/null || echo '__MISSING__'", unitPath), false)
+	if err != nil {
+		fmt.Printf("  service unit sync: could not reach %s (%v)\n", name, err)
+		return false, nil
+	}
+	remote = strings.TrimSpace(remote)
+	rendered := strings.TrimSpace(renderedUnit)
+
+	if remote == "__MISSING__" {
+		fmt.Printf("  service unit: %s not found (cloud-init will handle it)\n", name)
+		return false, nil
+	}
+
+	if remote == rendered {
+		fmt.Printf("  service unit: %s up to date\n", name)
+		return false, nil
+	}
+
+	// Write the updated unit file
+	script := fmt.Sprintf("cat > %s << 'SVCEOF'\n%s\nSVCEOF", unitPath, rendered)
+	if _, err := runSSH(ip, script, false); err != nil {
+		return false, fmt.Errorf("write service unit: %w", err)
+	}
+	fmt.Printf("  service unit: %s updated\n", name)
+	return true, nil
+}
+
 // syncConfigKeys fetches the existing config from a server and merges in any
 // missing keys from the rendered template. Existing values are never overwritten.
 func syncConfigKeys(name, ip, configPath, templateYAML string) error {

deploy/upcloud/configs/hold.yaml.tmpl

@@ -51,3 +51,4 @@ quota:
         new_crew_tier: deckhand
 scanner:
     secret: ""
+

deploy/upcloud/update.go

@@ -55,12 +55,17 @@ func cmdUpdate(target string) error {
 		return err
 	}
 
+	vals := configValsFromState(state)
+
 	targets := map[string]struct {
 		ip          string
 		binaryName  string
 		buildCmd    string
 		serviceName string
 		healthURL   string
+		configTmpl  string
+		configPath  string
+		unitTmpl    string
 	}{
 		"appview": {
 			ip:          state.Appview.PublicIP,
@@ -68,6 +73,9 @@ func cmdUpdate(target string) error {
 			buildCmd:    "appview",
 			serviceName: naming.Appview(),
 			healthURL:   "http://localhost:5000/health",
+			configTmpl:  appviewConfigTmpl,
+			configPath:  naming.AppviewConfigPath(),
+			unitTmpl:    appviewServiceTmpl,
 		},
 		"hold": {
 			ip:          state.Hold.PublicIP,
@@ -75,6 +83,9 @@ func cmdUpdate(target string) error {
 			buildCmd:    "hold",
 			serviceName: naming.Hold(),
 			healthURL:   "http://localhost:8080/xrpc/_health",
+			configTmpl:  holdConfigTmpl,
+			configPath:  naming.HoldConfigPath(),
+			unitTmpl:    holdServiceTmpl,
 		},
 	}
 
@@ -92,6 +103,37 @@ func cmdUpdate(target string) error {
 		t := targets[name]
 		fmt.Printf("Updating %s (%s)...\n", name, t.ip)
 
+		// Sync config keys (adds missing keys from template, never overwrites)
+		configYAML, err := renderConfig(t.configTmpl, vals)
+		if err != nil {
+			return fmt.Errorf("render %s config: %w", name, err)
+		}
+		if err := syncConfigKeys(name, t.ip, t.configPath, configYAML); err != nil {
+			return fmt.Errorf("%s config sync: %w", name, err)
+		}
+
+		// Sync systemd service unit
+		renderedUnit, err := renderServiceUnit(t.unitTmpl, serviceUnitParams{
+			DisplayName: naming.DisplayName(),
+			User:        naming.SystemUser(),
+			BinaryPath:  naming.InstallDir() + "/bin/" + t.binaryName,
+			ConfigPath:  t.configPath,
+			DataDir:     naming.BasePath(),
+			ServiceName: t.serviceName,
+		})
+		if err != nil {
+			return fmt.Errorf("render %s service unit: %w", name, err)
+		}
+		unitChanged, err := syncServiceUnit(name, t.ip, t.serviceName, renderedUnit)
+		if err != nil {
+			return fmt.Errorf("%s service unit sync: %w", name, err)
+		}
+
+		daemonReload := ""
+		if unitChanged {
+			daemonReload = "systemctl daemon-reload"
+		}
+
 		updateScript := fmt.Sprintf(`set -euo pipefail
 export PATH=$PATH:/usr/local/go/bin
 export GOTMPDIR=/var/tmp
@@ -113,11 +155,12 @@ CGO_ENABLED=1 go build \
     -ldflags="-s -w -linkmode external -extldflags '-static'" \
     -tags sqlite_omit_load_extension -trimpath \
     -o bin/%s ./cmd/%s
+%s
 systemctl restart %s
 
 sleep 2
 curl -sf %s > /dev/null && echo "HEALTH_OK" || echo "HEALTH_FAIL"
-`, goVersion, naming.InstallDir(), branch, t.binaryName, t.buildCmd, t.serviceName, t.healthURL)
+`, goVersion, naming.InstallDir(), branch, t.binaryName, t.buildCmd, daemonReload, t.serviceName, t.healthURL)
 
 		output, err := runSSH(t.ip, updateScript, true)
 		if err != nil {
@@ -139,6 +182,27 @@ curl -sf %s > /dev/null && echo "HEALTH_OK" || echo "HEALTH_FAIL"
 	return nil
 }
 
+// configValsFromState builds ConfigValues from persisted state.
+// S3SecretKey is intentionally left empty — syncConfigKeys only adds missing
+// keys and never overwrites, so the server's existing secret is preserved.
+func configValsFromState(state *InfraState) *ConfigValues {
+	naming := state.Naming()
+	_, baseDomain, _, _ := extractFromAppviewTemplate()
+	holdDomain := state.Zone + ".cove." + baseDomain
+
+	return &ConfigValues{
+		S3Endpoint:  state.ObjectStorage.Endpoint,
+		S3Region:    state.ObjectStorage.Region,
+		S3Bucket:    state.ObjectStorage.Bucket,
+		S3AccessKey: state.ObjectStorage.AccessKeyID,
+		S3SecretKey: "", // not persisted in state; existing value on server is preserved
+		Zone:        state.Zone,
+		HoldDomain:  holdDomain,
+		HoldDid:     "did:web:" + holdDomain,
+		BasePath:    naming.BasePath(),
+	}
+}
+
 func cmdSSH(target string) error {
 	state, err := loadState()
 	if err != nil {