[xss3cut10n3r]

A redesign of fvol serve: the web UI now works like a desktop forensics tool, with a start
screen, runs of several plugins, presets, every global fvol option, and analyses that are
saved and come back when a dump is reopened.

What changes

• Quick Start on launch: continue with the -f image, browse for a new one (including the
  desktop's own file dialog via kdialog/zenity on loopback), or reopen a previous analysis.
• Workspace in four resizable panels: File Overview (the image and windows.info facts,
  printed line by line), Plugins, Runs, and Triage Hints.
• Plugins: a Select tab (tick plugins, their options unfold underneath) and a Presets tab
  with six built-in sets (System Information, Windows Triage, Windows Malware and Persistence,
  Linux Triage, Linux Rootkit Hunt, macOS Triage) plus the user's own (Save Preset).
• Runs: the ticked plugins start together as one named run, a few at a time. Results
  replace the left two panels, a tab per plugin; one filter applies across a run's plugins and
  is kept per run. Columns can be moved, resized and fitted; process trees draw proper guides.
• Options: every global fvol option, each applied where the web UI has the same step
  (opening the image, each run, or the new fvol output export). See docs/web-ui.md.
• Triage rules: Load Rules… adds the user's own JSON checks next to the built-in hints.
• Saved analyses: ~/.fvol/<dump_id>-metadata.json (dump path, size, mtime, options,
  rules, runs) plus each plugin's rows in ~/.fvol/<dump_id>/<run>/<n>.jsonl. dump_id is the
  ~/.cache/fastvol image key, so a reopened dump finds warm caches; results come back without
  re-running anything. --clear-cache never touches ~/.fvol. Delete in Previous removes an
  analysis (never the dump).
• System fonts replace the embedded JetBrains Mono; the old UI's files are removed.

Behaviour changes to be aware of

• fvol serve now writes to ~/.fvol by default (0700 folder, 0600 files). Those files
  hold case paths, options and result rows. If you would rather have this opt-in or add a
  --no-save flag, it is a small change: say which you prefer.
• The options can name files the server writes: --save-config only into a run's output
  folder, -l only to a regular *.log file (one line per run, control characters replaced).
• POST /api/session still accepts symbol_dirs; it now goes through the options (-s on the
  command line still wins over an analysis's saved options).
• New API routes: /api/batches, /api/options, /api/rules, /api/analyses (with
  DELETE /api/analyses/<dump_id>), /api/presets and /api/pick-file (all in docs/web-ui.md).
• The old UI's hex viewer, process view, run comparison and timeline are not part of the new
  UI. /api/mem and /api/disasm are still there.
• bench/web/serve.sh gives test servers their own HOME, so they never write the
  developer's ~/.fvol (the caches stay shared).

The project's rules

• [dependencies] stays empty; the UI is hand-written HTML/CSS/JS with no build step.
• CLI output is untouched: the change is limited to src/web, bench/web, docs and README.
• No panic on bad input: damaged saved files and option values give error messages.
• Nothing is taken from vol-rs.

Tested

• Static fast build warning-free on Rust 1.95; cargo test --profile fast --locked: 609
  passed, 109 ignored. One failure, codecs::xz::tests::codecs_xz_real_isf, is unrelated and
  pre-existing: it only runs when ~/.cache/volatility3 holds that ISF, and it hard-codes the
  checksum of one particular conversion (the file embeds its conversion time).
• CI's smoke test and README-artwork check pass locally.
• End to end on a Windows 11 image: a run is saved, the server restarted, the analysis reopened
  from Previous; restored rows are identical to a fresh run and no plugin re-ran. Options
  checked for their effect (-e, --write-config output identical to fvol --save-config,
  -l, -r/--hide-columns, --parallelism off, --offline reopening).
• bench/web/shots.py (rewritten for the new UI, with a readme step and --scrub for local
  paths) and bench/web/perf.sh (browser part ported) pass.
• Not tested here: arm64, the newest stable Rust, and bench/web/e2e.sh (needs the Linux test
  image).