Restructure backend into services and fix security, crash and sync issues

Security
- Serve character images through os.Root so names like ../ can't escape
  the characters folder
- Sync start and /sync/reset are POST only (legacy and /api/v1)
- /api/v1/token/cleanup requires a token, password compared in constant
  time, tokens no longer logged
- Echo's rate limiter replaces the custom one; TRUSTED_PROXIES enables
  X-Forwarded-For for reverse proxies

Crashes and races
- Sync state lives in SyncService with atomics and a mutex instead of
  unsynchronised globals (fixes concurrent map writes during full sync)
- Only one sync can run; /api/v1 sync and music routes are locked during
  sync like the legacy ones
- No log.Fatal outside startup: errors become 4xx/5xx responses
- Search uses an in-order character match instead of unescaped regexes
- Empty queue / no songs return 404 instead of panicking or looping

Behaviour
- Sync result is computed once and stays the same between polls
- Swagger and /openapi serve the embedded spec
- Shutdown stops HTTP before closing the database
- Expired tokens are deleted with a context that outlives the request
- Files are served with Range support and correct content types; audio
  has no write deadline

Performance
- Migration 000006 adds soundtrack.fingerprint (names, sizes, mtimes) so
  unchanged folders are skipped without reading any files
- Songs are reconciled per soundtrack with one query plus needed writes;
  renames keep play counts
- Moved MUSIC_PATH updates soundtrack and song paths
- .id cleanup only runs for changed soundtracks or a full sync
- Classic random uses one SQL query; Gitea release lookups are cached
  with a timeout

Structure
- internal/config reads all environment variables once
- sqlc emits a Querier interface; backend globals become services
  injected into handlers
- One route registration shared by legacy and /api/v1
- Removed dead code (dbHelper.go, unused middleware, duplicate Gitea
  functions, embedded Swagger UI copy) and lib/pq
- templ and swag pinned as go tools

internal/db/queries/song.sql

@@ -41,7 +41,7 @@ SELECT * FROM song WHERE uuid = $1;
 DELETE FROM song WHERE soundtrack_id = $1 AND path = $2;
 
 -- name: RemoveBrokenSongs :exec
-DELETE FROM song WHERE uuid = ANY($1);
+DELETE FROM song WHERE uuid = ANY(sqlc.arg(uuids)::uuid[]);
 
 -- name: GetSongsBySoundtrackUUID :many
 SELECT *
@@ -50,3 +50,15 @@ WHERE soundtrack_uuid = $1;
 
 -- name: GetSongUUIDsBySoundtrackId :many
 SELECT uuid, soundtrack_uuid FROM song WHERE soundtrack_id = $1;
+
+-- name: UpdateSongByUUID :exec
+UPDATE song SET song_name=sqlc.arg(song_name), file_name=sqlc.arg(file_name), path=sqlc.arg(path), hash=sqlc.arg(hash)
+WHERE uuid=sqlc.arg(uuid);
+
+-- name: GetRandomActiveSong :one
+SELECT sqlc.embed(song), soundtrack.path AS soundtrack_path
+FROM song
+JOIN soundtrack ON soundtrack.id = song.soundtrack_id
+WHERE soundtrack.deleted IS NULL
+ORDER BY random()
+LIMIT 1;