Restructure backend into services and fix security, crash and sync issues

Security
- Serve character images through os.Root so names like ../ can't escape
  the characters folder
- Sync start and /sync/reset are POST only (legacy and /api/v1)
- /api/v1/token/cleanup requires a token, password compared in constant
  time, tokens no longer logged
- Echo's rate limiter replaces the custom one; TRUSTED_PROXIES enables
  X-Forwarded-For for reverse proxies

Crashes and races
- Sync state lives in SyncService with atomics and a mutex instead of
  unsynchronised globals (fixes concurrent map writes during full sync)
- Only one sync can run; /api/v1 sync and music routes are locked during
  sync like the legacy ones
- No log.Fatal outside startup: errors become 4xx/5xx responses
- Search uses an in-order character match instead of unescaped regexes
- Empty queue / no songs return 404 instead of panicking or looping

Behaviour
- Sync result is computed once and stays the same between polls
- Swagger and /openapi serve the embedded spec
- Shutdown stops HTTP before closing the database
- Expired tokens are deleted with a context that outlives the request
- Files are served with Range support and correct content types; audio
  has no write deadline

Performance
- Migration 000006 adds soundtrack.fingerprint (names, sizes, mtimes) so
  unchanged folders are skipped without reading any files
- Songs are reconciled per soundtrack with one query plus needed writes;
  renames keep play counts
- Moved MUSIC_PATH updates soundtrack and song paths
- .id cleanup only runs for changed soundtracks or a full sync
- Classic random uses one SQL query; Gitea release lookups are cached
  with a timeout

Structure
- internal/config reads all environment variables once
- sqlc emits a Querier interface; backend globals become services
  injected into handlers
- One route registration shared by legacy and /api/v1
- Removed dead code (dbHelper.go, unused middleware, duplicate Gitea
  functions, embedded Swagger UI copy) and lib/pq
- templ and swag pinned as go tools

cmd/main.go

@@ -2,84 +2,41 @@ package main
 
 import (
 	"context"
-	"music-server/internal/logging"
-	"music-server/internal/server"
-	"net/http"
 	"os/signal"
 	"syscall"
 	"time"
 
+	"music-server/internal/logging"
+	"music-server/internal/server"
+
 	"go.uber.org/zap"
 )
 
-//
-//	@Title			Swagger Example API
-//	@version		0.5
-//	@description	This is a sample server Petstore server.
-//	@termsOfService	http://swagger.io/terms/
+const shutdownTimeout = 5 * time.Second
 
-//
-//	@contact.name	Sebastian Olsson
-//	@contact.email	zarnor91@gmail.com
-
-//
-//	@license.name	Apache 2.0
-//	@license.url	http://www.apache.org/licenses/LICENSE-2.0.html
-
-// @host	localhost:8080
 func main() {
-	/*f, perr := os.Create("cpu.pprof")
-	if perr != nil {
-		log.Fatal(perr)
-	}
-	pprof.StartCPUProfile(f)
-	defer pprof.StopCPUProfile()*/
-
-	appServer := server.NewServerInstance()
-	httpServer := appServer.HTTPServer()
-
-	// Create a done channel to signal when the shutdown is complete
-	done := make(chan bool, 1)
-
-	// Run graceful shutdown in a separate goroutine
-	go gracefulShutdown(appServer, httpServer, done)
-
-	logging.GetLogger().Info("Server starting", zap.String("address", httpServer.Addr))
-	err := httpServer.ListenAndServe()
-	if err != nil && err != http.ErrServerClosed {
-		logging.GetLogger().Fatal("HTTP server error", zap.String("error", err.Error()))
-	}
-
-	// Wait for the graceful shutdown to complete
-	<-done
-	logging.GetLogger().Info("Graceful shutdown complete")
-}
-
-func gracefulShutdown(appServer *server.Server, httpServer *http.Server, done chan bool) {
-	// Create context that listens for the interrupt signal from the OS.
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
 
-	// Listen for the interrupt signal.
-	<-ctx.Done()
+	s := server.NewServerInstance()
 
-	logging.GetLogger().Info("Shutting down gracefully, press Ctrl+C again to force")
-	
-	// Close database connection
-	if appServer != nil && appServer.DB() != nil {
-		appServer.DB().Close()
+	serveErr := make(chan error, 1)
+	go func() { serveErr <- s.ListenAndServe() }()
+
+	select {
+	case err := <-serveErr:
+		if err != nil {
+			logging.GetLogger().Fatal("HTTP server error", zap.Error(err))
+		}
+	case <-ctx.Done():
+		stop()
+		logging.GetLogger().Info("Shutting down gracefully, press Ctrl+C again to force")
 	}
 
-	// The context is used to inform the server it has 5 seconds to finish
-	// the request it is currently handling
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	shutdownCtx, cancel := context.WithTimeout(context.Background(), shutdownTimeout)
 	defer cancel()
-	if err := httpServer.Shutdown(ctx); err != nil {
-		logging.GetLogger().Error("Server forced to shutdown with error", zap.String("error", err.Error()))
+	if err := s.Shutdown(shutdownCtx); err != nil {
+		logging.GetLogger().Error("Server forced to shutdown with error", zap.Error(err))
 	}
-
-	logging.GetLogger().Info("Server exiting")
-
-	// Notify the main goroutine that the shutdown is complete
-	done <- true
+	logging.GetLogger().Info("Graceful shutdown complete")
 }