Restructure backend into services and fix security, crash and sync issues

Security
- Serve character images through os.Root so names like ../ can't escape
  the characters folder
- Sync start and /sync/reset are POST only (legacy and /api/v1)
- /api/v1/token/cleanup requires a token, password compared in constant
  time, tokens no longer logged
- Echo's rate limiter replaces the custom one; TRUSTED_PROXIES enables
  X-Forwarded-For for reverse proxies

Crashes and races
- Sync state lives in SyncService with atomics and a mutex instead of
  unsynchronised globals (fixes concurrent map writes during full sync)
- Only one sync can run; /api/v1 sync and music routes are locked during
  sync like the legacy ones
- No log.Fatal outside startup: errors become 4xx/5xx responses
- Search uses an in-order character match instead of unescaped regexes
- Empty queue / no songs return 404 instead of panicking or looping

Behaviour
- Sync result is computed once and stays the same between polls
- Swagger and /openapi serve the embedded spec
- Shutdown stops HTTP before closing the database
- Expired tokens are deleted with a context that outlives the request
- Files are served with Range support and correct content types; audio
  has no write deadline

Performance
- Migration 000006 adds soundtrack.fingerprint (names, sizes, mtimes) so
  unchanged folders are skipped without reading any files
- Songs are reconciled per soundtrack with one query plus needed writes;
  renames keep play counts
- Moved MUSIC_PATH updates soundtrack and song paths
- .id cleanup only runs for changed soundtracks or a full sync
- Classic random uses one SQL query; Gitea release lookups are cached
  with a timeout

Structure
- internal/config reads all environment variables once
- sqlc emits a Querier interface; backend globals become services
  injected into handlers
- One route registration shared by legacy and /api/v1
- Removed dead code (dbHelper.go, unused middleware, duplicate Gitea
  functions, embedded Swagger UI copy) and lib/pq
- templ and swag pinned as go tools

internal/config/config.go

@@ -0,0 +1,118 @@
+// Package config loads the application configuration from environment variables.
+package config
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"strconv"
+	"strings"
+)
+
+// DefaultReleasesURL is the Gitea endpoint used to look up the latest client release.
+const DefaultReleasesURL = "https://gitea.sanplex.xyz/api/v1/repos/sansan/MusicPlayer/releases/latest"
+
+// Config holds all settings read from the environment.
+type Config struct {
+	Port int
+
+	DBHost     string
+	DBPort     string
+	DBUser     string
+	DBPassword string
+	DBName     string
+
+	MusicPath      string
+	CharactersPath string
+	SoundCheckPath string
+	FrontendPath   string
+
+	LogLevel string
+	LogJSON  bool
+
+	// APIPassword is required to create tokens. Empty means any password is accepted.
+	APIPassword        string
+	DisableSessionAuth bool
+
+	// TrustedProxies are CIDR ranges whose X-Forwarded-For header is trusted when resolving client IPs.
+	TrustedProxies []*net.IPNet
+
+	ReleasesURL string
+}
+
+// Load reads the configuration from the environment and validates it.
+func Load() (Config, error) {
+	return load(os.Getenv)
+}
+
+func load(getenv func(string) string) (Config, error) {
+	cfg := Config{
+		DBHost:             getenv("DB_HOST"),
+		DBPort:             getenv("DB_PORT"),
+		DBUser:             getenv("DB_USERNAME"),
+		DBPassword:         getenv("DB_PASSWORD"),
+		DBName:             getenv("DB_NAME"),
+		MusicPath:          getenv("MUSIC_PATH"),
+		CharactersPath:     getenv("CHARACTERS_PATH"),
+		SoundCheckPath:     withDefault(getenv("SOUND_CHECK_PATH"), "songs"),
+		FrontendPath:       withDefault(getenv("FRONTEND_PATH"), "/frontend"),
+		LogLevel:           withDefault(getenv("LOG_LEVEL"), "info"),
+		LogJSON:            getenv("LOG_JSON") == "true",
+		APIPassword:        getenv("API_PASSWORD"),
+		DisableSessionAuth: getenv("DISABLE_SESSION_AUTH") == "true",
+		ReleasesURL:        withDefault(getenv("RELEASES_URL"), DefaultReleasesURL),
+	}
+
+	var errs []error
+
+	port, err := strconv.Atoi(withDefault(getenv("PORT"), "8080"))
+	if err != nil {
+		errs = append(errs, fmt.Errorf("PORT: %w", err))
+	}
+	cfg.Port = port
+
+	for name, value := range map[string]string{
+		"DB_HOST":         cfg.DBHost,
+		"DB_PORT":         cfg.DBPort,
+		"DB_USERNAME":     cfg.DBUser,
+		"DB_PASSWORD":     cfg.DBPassword,
+		"DB_NAME":         cfg.DBName,
+		"MUSIC_PATH":      cfg.MusicPath,
+		"CHARACTERS_PATH": cfg.CharactersPath,
+	} {
+		if value == "" {
+			errs = append(errs, fmt.Errorf("%s is required", name))
+		}
+	}
+
+	cfg.TrustedProxies, err = parseCIDRs(getenv("TRUSTED_PROXIES"))
+	if err != nil {
+		errs = append(errs, fmt.Errorf("TRUSTED_PROXIES: %w", err))
+	}
+
+	return cfg, errors.Join(errs...)
+}
+
+func parseCIDRs(value string) ([]*net.IPNet, error) {
+	var nets []*net.IPNet
+	for part := range strings.SplitSeq(value, ",") {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			continue
+		}
+		_, ipNet, err := net.ParseCIDR(part)
+		if err != nil {
+			return nil, err
+		}
+		nets = append(nets, ipNet)
+	}
+	return nets, nil
+}
+
+func withDefault(value, fallback string) string {
+	if value == "" {
+		return fallback
+	}
+	return value
+}