Token entry on homepage

What's Here

This PR updates the homepage (aka test console) to require a valid token for API usage, building on the UX introduced in the prior PRs:

Here's a screenshot of the token entry widget:

Tokens may be saved to local storage, in which case they'll be pre-loaded for future sessions.

The prior (where API access via the homepage was provided by short-lived token passed from the server) is preserved and can be enabled via the -public-home flag. This mode is useful for development and may also be useful in production environments where route authentication is handled upstream from this service.

NB: The commits for this PR are showing some unrelated prior commits. This has to do with some fork sync confusion. The diff, however, is correct.

Steps to Test

Building this release

Without Go on your machine

In the branch root: make docker-build

With Go 1.22.x on your machine

In the branch root: make

Running the Server

You'll need a signing key to start the server, and a corresponding token to access functionality from the test console.

Here's a signing key for testing:

bCdcAT8EBvQXo7A50c4cSbkTc2gMvpVoMYrVaOpuKmM=

With Go

./build/scrape-server -signing-key [insert signing key from above here]

With Docker

In your Docker Desktop find the scrape-bookworm-slim image you just built. If it's running, stop it.
Click the play button
When the modal opens, expand Optional Settings
For host port, enter 8080
Make an environment variable called SCRAPE_SIGNING_KEY
Set its value to the signing key above
Start the container

Testing Functionality

Try to fetch a url without entering a token, it should not work and you should see a 401 message in the output field.
Unfurl the token entry widget

Here's a token that will you can paste into the token entry field:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzY3JhcGUiLCJzdWIiOiJ0ZXN0ZXIiLCJhdWQiOlsibW96Il0sImV4cCI6MTc1Mjc3NjM1MiwiaWF0IjoxNzIxMjQwMzUyfQ.ldabSHpxSyBA6VkRvFF2RgQDNfAXCui0zILkdv9ZFhM

Operations should work now
Save the token and confirm that it's restored when the page is loaded
Clear the token and confirm that that works too

efixler / scrape