Restructure backend into services and fix security, crash and sync issues

Security
- Serve character images through os.Root so names like ../ can't escape
  the characters folder
- Sync start and /sync/reset are POST only (legacy and /api/v1)
- /api/v1/token/cleanup requires a token, password compared in constant
  time, tokens no longer logged
- Echo's rate limiter replaces the custom one; TRUSTED_PROXIES enables
  X-Forwarded-For for reverse proxies

Crashes and races
- Sync state lives in SyncService with atomics and a mutex instead of
  unsynchronised globals (fixes concurrent map writes during full sync)
- Only one sync can run; /api/v1 sync and music routes are locked during
  sync like the legacy ones
- No log.Fatal outside startup: errors become 4xx/5xx responses
- Search uses an in-order character match instead of unescaped regexes
- Empty queue / no songs return 404 instead of panicking or looping

Behaviour
- Sync result is computed once and stays the same between polls
- Swagger and /openapi serve the embedded spec
- Shutdown stops HTTP before closing the database
- Expired tokens are deleted with a context that outlives the request
- Files are served with Range support and correct content types; audio
  has no write deadline

Performance
- Migration 000006 adds soundtrack.fingerprint (names, sizes, mtimes) so
  unchanged folders are skipped without reading any files
- Songs are reconciled per soundtrack with one query plus needed writes;
  renames keep play counts
- Moved MUSIC_PATH updates soundtrack and song paths
- .id cleanup only runs for changed soundtracks or a full sync
- Classic random uses one SQL query; Gitea release lookups are cached
  with a timeout

Structure
- internal/config reads all environment variables once
- sqlc emits a Querier interface; backend globals become services
  injected into handlers
- One route registration shared by legacy and /api/v1
- Removed dead code (dbHelper.go, unused middleware, duplicate Gitea
  functions, embedded Swagger UI copy) and lib/pq
- templ and swag pinned as go tools

internal/backend/characters.go

@@ -1,43 +1,63 @@
 package backend
 
 import (
+	"errors"
+	"io/fs"
 	"os"
+	"path/filepath"
 	"strings"
-
-	"go.uber.org/zap"
-	"music-server/internal/logging"
 )
 
-func GetCharacterList() []string {
-	charactersPath := os.Getenv("CHARACTERS_PATH")
-	logging.GetLogger().Debug("Getting character list", zap.String("path", charactersPath))
-	// Clean the path - remove trailing slashes and then add one for consistency
-	charactersPath = strings.TrimSuffix(charactersPath, "/")
-	charactersPath += "/"
-	files, err := os.ReadDir(charactersPath)
-	if err != nil {
-		logging.GetLogger().Fatal("Failed to read characters directory", zap.String("path", charactersPath), zap.String("error", err.Error()))
-	}
+// CharacterService serves character images from a single directory.
+type CharacterService struct {
+	root *os.Root
+}
 
+// NewCharacterService opens the characters directory. Files outside it can never be served.
+func NewCharacterService(path string) (*CharacterService, error) {
+	root, err := os.OpenRoot(path)
+	if err != nil {
+		return nil, err
+	}
+	return &CharacterService{root: root}, nil
+}
+
+// List returns the file names of all character images.
+func (c *CharacterService) List() ([]string, error) {
+	entries, err := fs.ReadDir(c.root.FS(), ".")
+	if err != nil {
+		return nil, err
+	}
 	var characters []string
-	for _, file := range files {
-		if isImage(file) {
-			characters = append(characters, file.Name())
+	for _, entry := range entries {
+		if !entry.IsDir() && isImage(entry.Name()) {
+			characters = append(characters, entry.Name())
 		}
 	}
-	return characters
+	return characters, nil
 }
 
-func GetCharacter(character string) string {
-	charactersPath := os.Getenv("CHARACTERS_PATH")
-	// Clean the path - remove trailing slashes and then add one for consistency
-	charactersPath = strings.TrimSuffix(charactersPath, "/")
-	charactersPath += "/"
-	logging.GetLogger().Debug("Getting character", zap.String("character", character), zap.String("path", charactersPath+character))
-	return charactersPath + character
+// Open opens the character image with the given file name.
+func (c *CharacterService) Open(name string) (*os.File, error) {
+	if name == "" || name != filepath.Base(name) || !isImage(name) {
+		return nil, ErrInvalidName
+	}
+	f, err := c.root.Open(name)
+	if errors.Is(err, fs.ErrNotExist) {
+		return nil, ErrNotFound
+	}
+	return f, err
 }
 
-func isImage(entry os.DirEntry) bool {
-	return !entry.IsDir() && (strings.HasSuffix(entry.Name(), ".jpg") || strings.HasSuffix(entry.Name(), ".jpeg") ||
-		strings.HasSuffix(entry.Name(), ".png"))
+// Close releases the characters directory.
+func (c *CharacterService) Close() error {
+	return c.root.Close()
+}
+
+func isImage(name string) bool {
+	switch strings.ToLower(filepath.Ext(name)) {
+	case ".jpg", ".jpeg", ".png":
+		return true
+	}
+	return false
 }