Restructure backend into services and fix security, crash and sync issues

Security
- Serve character images through os.Root so names like ../ can't escape
  the characters folder
- Sync start and /sync/reset are POST only (legacy and /api/v1)
- /api/v1/token/cleanup requires a token, password compared in constant
  time, tokens no longer logged
- Echo's rate limiter replaces the custom one; TRUSTED_PROXIES enables
  X-Forwarded-For for reverse proxies

Crashes and races
- Sync state lives in SyncService with atomics and a mutex instead of
  unsynchronised globals (fixes concurrent map writes during full sync)
- Only one sync can run; /api/v1 sync and music routes are locked during
  sync like the legacy ones
- No log.Fatal outside startup: errors become 4xx/5xx responses
- Search uses an in-order character match instead of unescaped regexes
- Empty queue / no songs return 404 instead of panicking or looping

Behaviour
- Sync result is computed once and stays the same between polls
- Swagger and /openapi serve the embedded spec
- Shutdown stops HTTP before closing the database
- Expired tokens are deleted with a context that outlives the request
- Files are served with Range support and correct content types; audio
  has no write deadline

Performance
- Migration 000006 adds soundtrack.fingerprint (names, sizes, mtimes) so
  unchanged folders are skipped without reading any files
- Songs are reconciled per soundtrack with one query plus needed writes;
  renames keep play counts
- Moved MUSIC_PATH updates soundtrack and song paths
- .id cleanup only runs for changed soundtracks or a full sync
- Classic random uses one SQL query; Gitea release lookups are cached
  with a timeout

Structure
- internal/config reads all environment variables once
- sqlc emits a Querier interface; backend globals become services
  injected into handlers
- One route registration shared by legacy and /api/v1
- Removed dead code (dbHelper.go, unused middleware, duplicate Gitea
  functions, embedded Swagger UI copy) and lib/pq
- templ and swag pinned as go tools

cmd/web/search.go

@@ -1,77 +1,57 @@
 package web
 
 import (
-	"log"
-	"music-server/internal/backend"
 	"net/http"
 	"strings"
+
+	"music-server/internal/backend"
+	"music-server/internal/logging"
+
+	"go.uber.org/zap"
 )
 
-var soundtracks_added []string
+// NewSearchHandler returns a handler that renders the soundtracks matching the posted search term.
+func NewSearchHandler(cache *backend.SearchCache) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if err := r.ParseForm(); err != nil {
+			http.Error(w, "Bad Request", http.StatusBadRequest)
+			return
+		}
 
-func FindSoundtrackWebHandler(w http.ResponseWriter, r *http.Request) {
-	err := r.ParseForm()
-	if err != nil {
-		http.Error(w, "Bad Request", http.StatusBadRequest)
-		return
-	}
+		soundtracks, err := cache.Get(r.Context())
+		if err != nil {
+			logging.GetLogger().Error("Failed to load search data", zap.Error(err))
+			http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+			return
+		}
 
-	search_term := r.FormValue("search_term")
-	search(search_term)
-	results := soundtracks_added
-
-	component := FoundSoundtracks(results)
-	err = component.Render(r.Context(), w)
-	if err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
-		log.Fatalf("Error rendering in FindSoundtrackWebHandler: %e", err)
-	}
+		results := search(r.FormValue("search_term"), soundtracks)
+		if err := FoundSoundtracks(results).Render(r.Context(), w); err != nil {
+			logging.GetLogger().Error("Failed to render search results", zap.Error(err))
+			http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		}
+	})
 }
 
-func search(searchText string) {
-	soundtracks_added = nil
-	soundtrackData := backend.GetSearchCache()
-	results := searchWithData(searchText, soundtrackData)
-	soundtracks_added = results
-}
-
-// searchWithData is a testable version of search that takes soundtrack data as a parameter
-func searchWithData(searchText string, soundtrackData []backend.SoundtrackData) []string {
+// search returns the soundtracks matching searchText: exact matches first, then matches
+// ignoring spaces and special characters, then matches with the letters in order.
+func search(searchText string, soundtrackData []backend.SoundtrackData) []string {
 	var results []string
 	seen := make(map[string]bool)
-
-	// Precompute cleaned and lowercase search terms once
-	cleanedSearchTerm := strings.ToLower(searchText)
-	cleanedSearchTerm = strings.ReplaceAll(cleanedSearchTerm, " ", "")
-	cleanedSearchTerm = strings.ReplaceAll(cleanedSearchTerm, "é", "e")
-	cleanedSearchTerm = strings.ReplaceAll(cleanedSearchTerm, "+", "plus")
-	cleanedSearchTerm = strings.ReplaceAll(cleanedSearchTerm, "&", "and")
-	cleanedSearchTerm = strings.ReplaceAll(cleanedSearchTerm, "'n", "and")
-	lowercaseSearchText := strings.ToLower(searchText)
-
-	// Pass 1: Exact match (case-insensitive contains)
-	for _, data := range soundtrackData {
-		if !seen[data.Original] && (searchText == "" || strings.Contains(data.Lowercase, lowercaseSearchText)) {
-			results = append(results, data.Original)
-			seen[data.Original] = true
+	add := func(match func(backend.SoundtrackData) bool) {
+		for _, data := range soundtrackData {
+			if !seen[data.Original] && match(data) {
+				results = append(results, data.Original)
+				seen[data.Original] = true
+			}
 		}
 	}
 
-	// Pass 2: Contains match with cleaned terms
-	for _, data := range soundtrackData {
-		if !seen[data.Original] && (cleanedSearchTerm == "" || strings.Contains(data.Cleaned, cleanedSearchTerm)) {
-			results = append(results, data.Original)
-			seen[data.Original] = true
-		}
-	}
-
-	// Pass 3: Regex match with cleaned terms
-	for _, data := range soundtrackData {
-		if !seen[data.Original] && backend.MatchRegexCached(cleanedSearchTerm, data.Cleaned) {
-			results = append(results, data.Original)
-			seen[data.Original] = true
-		}
-	}
+	lowercase := strings.ToLower(searchText)
+	cleaned := backend.CleanSearchTerm(searchText)
 
+	add(func(d backend.SoundtrackData) bool { return strings.Contains(d.Lowercase, lowercase) })
+	add(func(d backend.SoundtrackData) bool { return strings.Contains(d.Cleaned, cleaned) })
+	add(func(d backend.SoundtrackData) bool { return backend.MatchesSubsequence(cleaned, d.Cleaned) })
 	return results
 }