v0.24.0 — Pre-testing observability: debug logging, diagnostic dump, startup self-test

- Add [DEBUG] logging across all modules (backup, storage, sync, selfupdate,
  monitor, notify, report, assets, setup) gated behind logging.level: "debug"
- Add /api/debug/dump endpoint returning full controller state JSON (debug only)
- Add startup self-test validating 9 subsystems (Docker, dirs, storage, hub,
  restic repos, metrics DB) with pass/warn/fail summary
- New packages: internal/selftest, internal/util
- Constructor/signature changes: debug bool params, logger params on
  RunHealthCheck and BuildReport, smart watchdog probe logging

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/sync/sync.go

@@ -3,12 +3,14 @@ package sync
 import (
 	"bytes"
 	"crypto/sha256"
+	"encoding/hex"
 	"fmt"
 	"io"
 	"log"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
 	"strings"
 	"sync"
 	"time"
@@ -60,6 +62,17 @@ func New(cfg *config.Config, logger *log.Logger, rescanFn func() error, postSync
 	}
 }
 
+// isDebug returns true if the logging level is set to "debug".
+func (s *Syncer) isDebug() bool { return s.cfg.Logging.Level == "debug" }
+
+// maskRepoURL masks credentials in a git URL for safe logging.
+// e.g., "https://user:token@host/path" → "https://user:***@host/path"
+var reURLCreds = regexp.MustCompile(`(https?://)([^:]+):([^@]+)@`)
+
+func maskRepoURL(url string) string {
+	return reURLCreds.ReplaceAllString(url, "${1}${2}:***@")
+}
+
 // Start begins the periodic sync loop. Call Stop() to terminate.
 func (s *Syncer) Start() {
 	if s.cfg.Git.RepoURL == "" {
@@ -192,6 +205,9 @@ func (s *Syncer) doSync() SyncResult {
 
 	// Step 4: Inject missing deploy fields for updated stacks
 	if len(updated) > 0 && s.postSyncHook != nil {
+		if s.isDebug() {
+			s.logger.Printf("[DEBUG] [SYNC] Post-sync hook: triggering missing field injection for %d stack(s): %v", len(updated), updated)
+		}
 		s.postSyncHook(updated)
 	}
 
@@ -230,11 +246,17 @@ func (s *Syncer) gitCloneOrPull() error {
 		args := []string{"clone", "--depth", "1", "--branch", s.cfg.Git.Branch}
 		repoURL := s.buildRepoURL()
 		args = append(args, repoURL, s.cacheDir)
+		if s.isDebug() {
+			s.logger.Printf("[DEBUG] [SYNC] git clone URL: %s, branch: %s, cacheDir: %s", maskRepoURL(repoURL), s.cfg.Git.Branch, s.cacheDir)
+		}
 		return s.runGit(args...)
 	}
 
 	// Pull
 	s.logger.Printf("[SYNC] Pulling latest from %s (branch: %s)", s.cfg.Git.RepoURL, s.cfg.Git.Branch)
+	if s.isDebug() {
+		s.logger.Printf("[DEBUG] [SYNC] git fetch --depth 1 origin %s in %s", s.cfg.Git.Branch, s.cacheDir)
+	}
 	if err := s.runGitInDir(s.cacheDir, "fetch", "--depth", "1", "origin", s.cfg.Git.Branch); err != nil {
 		return fmt.Errorf("git fetch: %w", err)
 	}
@@ -290,6 +312,9 @@ func (s *Syncer) copyTemplates() (newApps []string, updated []string, err error)
 			dst := filepath.Join(dstDir, filename)
 
 			if _, err := os.Stat(src); os.IsNotExist(err) {
+				if s.isDebug() {
+					s.logger.Printf("[DEBUG] [SYNC] %s/%s: source not found, skipping", appName, filename)
+				}
 				continue
 			}
 
@@ -301,6 +326,11 @@ func (s *Syncer) copyTemplates() (newApps []string, updated []string, err error)
 			if changed {
 				anyChanged = true
 				s.logger.Printf("[SYNC] Updated %s/%s", appName, filename)
+				if s.isDebug() {
+					s.logFileHashes(appName, filename, src, dst)
+				}
+			} else if s.isDebug() {
+				s.logger.Printf("[DEBUG] [SYNC] %s/%s: hash match, skipped", appName, filename)
 			}
 		}
 
@@ -314,6 +344,22 @@ func (s *Syncer) copyTemplates() (newApps []string, updated []string, err error)
 	return newApps, updated, nil
 }
 
+// logFileHashes logs the source and destination file hashes for debugging.
+func (s *Syncer) logFileHashes(appName, filename, src, dst string) {
+	srcData, err := os.ReadFile(src)
+	if err != nil {
+		return
+	}
+	srcHash := sha256.Sum256(srcData)
+	dstData, err := os.ReadFile(dst)
+	if err != nil {
+		s.logger.Printf("[DEBUG] [SYNC] %s/%s: src=%s, dst=new file", appName, filename, hex.EncodeToString(srcHash[:8]))
+		return
+	}
+	dstHash := sha256.Sum256(dstData)
+	s.logger.Printf("[DEBUG] [SYNC] %s/%s: src=%s, dst=%s (changed)", appName, filename, hex.EncodeToString(srcHash[:8]), hex.EncodeToString(dstHash[:8]))
+}
+
 // copyIfChanged copies src to dst only if the content differs.
 // Returns true if the file was actually written.
 func copyIfChanged(src, dst string) (bool, error) {