Sonar's go-security taint engine kept flagging the explicit
distFS.Open(rel) call in the SPA-fallback handler even after path.Clean
+ ".." check. The pattern is structurally safe (embed.FS rejects ".."
on its own) but the engine can't model it.

Restructure: wrap the dist sub-FS with spaFS — when http.FileServer
hits ErrNotExist on an extensionless path, the wrapper transparently
serves index.html so the React router can claim the URL. Asset-shaped
paths (anything with ".") still 404 normally, so a missing favicon
doesn't surprise the browser with an HTML body.

Net result: the user-controlled URL never crosses our own Open() call —
http.FileServer is the only caller, and Sonar trusts that boundary.

Verification
  * go vet ./... clean
  * go test ./... — 516 pass / 27 packages
  * go build ./... clean

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The PR #74 amendment surfaced a second flaky test
(TestPipeline_PreservesInsertionOrder) that fails on CI under the race
detector for the same reason as the first: 2-second deadlines too tight.

Two fixes
  * Bulk-bump all remaining waitFor(t, 2*time.Second, ...) calls in
    pipeline_test.go to 5 seconds (5 sites). Tolerates race-detector
    overhead on slow CI runners; locally these all complete in
    milliseconds.
  * TestPipeline_PreservesInsertionOrder synced on Stats().Processed == 1
    but asserted on snapshotOrder() length. Stats() can bump between
    BatchCreate calls under the race detector, leaving the order
    snapshot partial. Switched the wait to len(w.snapshotOrder()) >= 3 —
    the actual condition the assertion cares about.

Verification
  * go test -race -count=3 ./internal/ingest/... — 114 pass × 3 runs
  * go vet ./... clean
  * locally reproducible-pass under -race

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

SonarCloud quality gate failed PR #74 on
new_duplicated_lines_density=3.5% (threshold 3%). The duplication is
between TestPipeline_FailedSpansSkipsLogs and
TestPipeline_FailedTracesAbortsBatch — same boilerplate, same waitFor,
same assertion shape. The waitFor 2s→5s bump made those lines "new
code", so Sonar recounted the existing duplication against the PR's
new-code budget.

Extract runFailureSkipsCheck(t, writer, forbidden...) — single helper
takes the configured fakeWriter and the BatchCreate* names that must
not fire after the seeded upstream failure. Each failing-path test
collapses to a single line.

Verification
  * go test -race -count=3 -run 'TestPipeline_Failed*' — pass × 3
  * go vet ./... clean

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>