Restructure backend into services and fix security, crash and sync issues

Security
- Serve character images through os.Root so names like ../ can't escape
  the characters folder
- Sync start and /sync/reset are POST only (legacy and /api/v1)
- /api/v1/token/cleanup requires a token, password compared in constant
  time, tokens no longer logged
- Echo's rate limiter replaces the custom one; TRUSTED_PROXIES enables
  X-Forwarded-For for reverse proxies

Crashes and races
- Sync state lives in SyncService with atomics and a mutex instead of
  unsynchronised globals (fixes concurrent map writes during full sync)
- Only one sync can run; /api/v1 sync and music routes are locked during
  sync like the legacy ones
- No log.Fatal outside startup: errors become 4xx/5xx responses
- Search uses an in-order character match instead of unescaped regexes
- Empty queue / no songs return 404 instead of panicking or looping

Behaviour
- Sync result is computed once and stays the same between polls
- Swagger and /openapi serve the embedded spec
- Shutdown stops HTTP before closing the database
- Expired tokens are deleted with a context that outlives the request
- Files are served with Range support and correct content types; audio
  has no write deadline

Performance
- Migration 000006 adds soundtrack.fingerprint (names, sizes, mtimes) so
  unchanged folders are skipped without reading any files
- Songs are reconciled per soundtrack with one query plus needed writes;
  renames keep play counts
- Moved MUSIC_PATH updates soundtrack and song paths
- .id cleanup only runs for changed soundtracks or a full sync
- Classic random uses one SQL query; Gitea release lookups are cached
  with a timeout

Structure
- internal/config reads all environment variables once
- sqlc emits a Querier interface; backend globals become services
  injected into handlers
- One route registration shared by legacy and /api/v1
- Removed dead code (dbHelper.go, unused middleware, duplicate Gitea
  functions, embedded Swagger UI copy) and lib/pq
- templ and swag pinned as go tools

internal/db/repository/song.sql.go

@@ -181,6 +181,37 @@ func (q *Queries) FindSongsFromSoundtrack(ctx context.Context, soundtrackID int3
 	return items, nil
 }
 
+const getRandomActiveSong = `-- name: GetRandomActiveSong :one
+SELECT song.soundtrack_id, song.song_name, song.path, song.times_played, song.hash, song.file_name, song.uuid, song.soundtrack_uuid, soundtrack.path AS soundtrack_path
+FROM song
+JOIN soundtrack ON soundtrack.id = song.soundtrack_id
+WHERE soundtrack.deleted IS NULL
+ORDER BY random()
+LIMIT 1
+`
+
+type GetRandomActiveSongRow struct {
+	Song           Song   `json:"song"`
+	SoundtrackPath string `json:"soundtrack_path"`
+}
+
+func (q *Queries) GetRandomActiveSong(ctx context.Context) (GetRandomActiveSongRow, error) {
+	row := q.db.QueryRow(ctx, getRandomActiveSong)
+	var i GetRandomActiveSongRow
+	err := row.Scan(
+		&i.Song.SoundtrackID,
+		&i.Song.SongName,
+		&i.Song.Path,
+		&i.Song.TimesPlayed,
+		&i.Song.Hash,
+		&i.Song.FileName,
+		&i.Song.Uuid,
+		&i.Song.SoundtrackUuid,
+		&i.SoundtrackPath,
+	)
+	return i, err
+}
+
 const getSongByUUID = `-- name: GetSongByUUID :one
 SELECT soundtrack_id, song_name, path, times_played, hash, file_name, uuid, soundtrack_uuid FROM song WHERE uuid = $1
 `
@@ -300,11 +331,11 @@ func (q *Queries) RemoveBrokenSong(ctx context.Context, arg RemoveBrokenSongPara
 }
 
 const removeBrokenSongs = `-- name: RemoveBrokenSongs :exec
-DELETE FROM song WHERE uuid = ANY($1)
+DELETE FROM song WHERE uuid = ANY($1::uuid[])
 `
 
-func (q *Queries) RemoveBrokenSongs(ctx context.Context, argUuid uuid.UUID) error {
-	_, err := q.db.Exec(ctx, removeBrokenSongs, argUuid)
+func (q *Queries) RemoveBrokenSongs(ctx context.Context, uuids []uuid.UUID) error {
+	_, err := q.db.Exec(ctx, removeBrokenSongs, uuids)
 	return err
 }
 
@@ -328,3 +359,27 @@ func (q *Queries) UpdateSong(ctx context.Context, arg UpdateSongParams) error {
 	)
 	return err
 }
+
+const updateSongByUUID = `-- name: UpdateSongByUUID :exec
+UPDATE song SET song_name=$1, file_name=$2, path=$3, hash=$4
+WHERE uuid=$5
+`
+
+type UpdateSongByUUIDParams struct {
+	SongName string    `json:"song_name"`
+	FileName *string   `json:"file_name"`
+	Path     string    `json:"path"`
+	Hash     string    `json:"hash"`
+	Uuid     uuid.UUID `json:"uuid"`
+}
+
+func (q *Queries) UpdateSongByUUID(ctx context.Context, arg UpdateSongByUUIDParams) error {
+	_, err := q.db.Exec(ctx, updateSongByUUID,
+		arg.SongName,
+		arg.FileName,
+		arg.Path,
+		arg.Hash,
+		arg.Uuid,
+	)
+	return err
+}