Restructure backend into services and fix security, crash and sync issues

Security
- Serve character images through os.Root so names like ../ can't escape
  the characters folder
- Sync start and /sync/reset are POST only (legacy and /api/v1)
- /api/v1/token/cleanup requires a token, password compared in constant
  time, tokens no longer logged
- Echo's rate limiter replaces the custom one; TRUSTED_PROXIES enables
  X-Forwarded-For for reverse proxies

Crashes and races
- Sync state lives in SyncService with atomics and a mutex instead of
  unsynchronised globals (fixes concurrent map writes during full sync)
- Only one sync can run; /api/v1 sync and music routes are locked during
  sync like the legacy ones
- No log.Fatal outside startup: errors become 4xx/5xx responses
- Search uses an in-order character match instead of unescaped regexes
- Empty queue / no songs return 404 instead of panicking or looping

Behaviour
- Sync result is computed once and stays the same between polls
- Swagger and /openapi serve the embedded spec
- Shutdown stops HTTP before closing the database
- Expired tokens are deleted with a context that outlives the request
- Files are served with Range support and correct content types; audio
  has no write deadline

Performance
- Migration 000006 adds soundtrack.fingerprint (names, sizes, mtimes) so
  unchanged folders are skipped without reading any files
- Songs are reconciled per soundtrack with one query plus needed writes;
  renames keep play counts
- Moved MUSIC_PATH updates soundtrack and song paths
- .id cleanup only runs for changed soundtracks or a full sync
- Classic random uses one SQL query; Gitea release lookups are cached
  with a timeout

Structure
- internal/config reads all environment variables once
- sqlc emits a Querier interface; backend globals become services
  injected into handlers
- One route registration shared by legacy and /api/v1
- Removed dead code (dbHelper.go, unused middleware, duplicate Gitea
  functions, embedded Swagger UI copy) and lib/pq
- templ and swag pinned as go tools

internal/backend/characters_test.go

@@ -1,90 +0,0 @@
-package backend
-
-import (
-	"io/fs"
-	"os"
-	"testing"
-)
-
-func TestIsImage(t *testing.T) {
-	tests := []struct {
-		name     string
-		entry    fs.DirEntry
-		expected bool
-	}{
-		{
-			name:     "jpg file",
-			entry:    &mockDirEntry{name: "test.jpg", isDir: false},
-			expected: true,
-		},
-		{
-			name:     "jpeg file",
-			entry:    &mockDirEntry{name: "test.jpeg", isDir: false},
-			expected: true,
-		},
-		{
-			name:     "png file",
-			entry:    &mockDirEntry{name: "test.png", isDir: false},
-			expected: true,
-		},
-		{
-			name:     "directory",
-			entry:    &mockDirEntry{name: "test", isDir: true},
-			expected: false,
-		},
-		{
-			name:     "txt file",
-			entry:    &mockDirEntry{name: "test.txt", isDir: false},
-			expected: false,
-		},
-		{
-			name:     "mp3 file",
-			entry:    &mockDirEntry{name: "test.mp3", isDir: false},
-			expected: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isImage(tt.entry)
-			if result != tt.expected {
-				t.Errorf("isImage() = %v, want %v", result, tt.expected)
-			}
-		})
-	}
-}
-
-type mockDirEntry struct {
-	name  string
-	isDir bool
-}
-
-func (m *mockDirEntry) Name() string       { return m.name }
-func (m *mockDirEntry) IsDir() bool         { return m.isDir }
-func (m *mockDirEntry) Type() fs.FileMode   { return 0 }
-func (m *mockDirEntry) Info() (fs.FileInfo, error) { return nil, nil }
-func (m *mockDirEntry) Sys() interface{}    { return nil }
-
-func TestGetCharacter(t *testing.T) {
-	os.Setenv("CHARACTERS_PATH", "/test/path")
-	defer os.Unsetenv("CHARACTERS_PATH")
-
-	result := GetCharacter("test.jpg")
-	expected := "/test/path/test.jpg"
-
-	if result != expected {
-		t.Errorf("GetCharacter() = %v, want %v", result, expected)
-	}
-}
-
-func TestGetCharacterWithTrailingSlash(t *testing.T) {
-	os.Setenv("CHARACTERS_PATH", "/test/path/")
-	defer os.Unsetenv("CHARACTERS_PATH")
-
-	result := GetCharacter("test.jpg")
-	expected := "/test/path/test.jpg"
-
-	if result != expected {
-		t.Errorf("GetCharacter() = %v, want %v", result, expected)
-	}
-}