Restructure backend into services and fix security, crash and sync issues

Security
- Serve character images through os.Root so names like ../ can't escape
  the characters folder
- Sync start and /sync/reset are POST only (legacy and /api/v1)
- /api/v1/token/cleanup requires a token, password compared in constant
  time, tokens no longer logged
- Echo's rate limiter replaces the custom one; TRUSTED_PROXIES enables
  X-Forwarded-For for reverse proxies

Crashes and races
- Sync state lives in SyncService with atomics and a mutex instead of
  unsynchronised globals (fixes concurrent map writes during full sync)
- Only one sync can run; /api/v1 sync and music routes are locked during
  sync like the legacy ones
- No log.Fatal outside startup: errors become 4xx/5xx responses
- Search uses an in-order character match instead of unescaped regexes
- Empty queue / no songs return 404 instead of panicking or looping

Behaviour
- Sync result is computed once and stays the same between polls
- Swagger and /openapi serve the embedded spec
- Shutdown stops HTTP before closing the database
- Expired tokens are deleted with a context that outlives the request
- Files are served with Range support and correct content types; audio
  has no write deadline

Performance
- Migration 000006 adds soundtrack.fingerprint (names, sizes, mtimes) so
  unchanged folders are skipped without reading any files
- Songs are reconciled per soundtrack with one query plus needed writes;
  renames keep play counts
- Moved MUSIC_PATH updates soundtrack and song paths
- .id cleanup only runs for changed soundtracks or a full sync
- Classic random uses one SQL query; Gitea release lookups are cached
  with a timeout

Structure
- internal/config reads all environment variables once
- sqlc emits a Querier interface; backend globals become services
  injected into handlers
- One route registration shared by legacy and /api/v1
- Removed dead code (dbHelper.go, unused middleware, duplicate Gitea
  functions, embedded Swagger UI copy) and lib/pq
- templ and swag pinned as go tools

internal/db/repository/soundtrack.sql.go

@@ -30,7 +30,7 @@ func (q *Queries) ClearSoundtracks(ctx context.Context) error {
 }
 
 const findAllSoundtracks = `-- name: FindAllSoundtracks :many
-SELECT id, soundtrack_name, added, deleted, last_changed, path, times_played, last_played, number_of_songs, hash, uuid
+SELECT id, soundtrack_name, added, deleted, last_changed, path, times_played, last_played, number_of_songs, hash, uuid, fingerprint
 FROM soundtrack
 WHERE deleted IS NULL
 ORDER BY soundtrack_name
@@ -57,6 +57,7 @@ func (q *Queries) FindAllSoundtracks(ctx context.Context) ([]Soundtrack, error)
 			&i.NumberOfSongs,
 			&i.Hash,
 			&i.Uuid,
+			&i.Fingerprint,
 		); err != nil {
 			return nil, err
 		}
@@ -69,7 +70,7 @@ func (q *Queries) FindAllSoundtracks(ctx context.Context) ([]Soundtrack, error)
 }
 
 const getAllSoundtracksIncludingDeleted = `-- name: GetAllSoundtracksIncludingDeleted :many
-SELECT id, soundtrack_name, added, deleted, last_changed, path, times_played, last_played, number_of_songs, hash, uuid
+SELECT id, soundtrack_name, added, deleted, last_changed, path, times_played, last_played, number_of_songs, hash, uuid, fingerprint
 FROM soundtrack
 ORDER BY soundtrack_name
 `
@@ -95,6 +96,7 @@ func (q *Queries) GetAllSoundtracksIncludingDeleted(ctx context.Context) ([]Soun
 			&i.NumberOfSongs,
 			&i.Hash,
 			&i.Uuid,
+			&i.Fingerprint,
 		); err != nil {
 			return nil, err
 		}
@@ -118,7 +120,7 @@ func (q *Queries) GetIdBySoundtrackName(ctx context.Context, soundtrackName stri
 }
 
 const getSoundtrackById = `-- name: GetSoundtrackById :one
-SELECT id, soundtrack_name, added, deleted, last_changed, path, times_played, last_played, number_of_songs, hash, uuid 
+SELECT id, soundtrack_name, added, deleted, last_changed, path, times_played, last_played, number_of_songs, hash, uuid, fingerprint 
 FROM soundtrack 
 WHERE id = $1 
 AND deleted IS NULL
@@ -139,12 +141,13 @@ func (q *Queries) GetSoundtrackById(ctx context.Context, id int32) (Soundtrack,
 		&i.NumberOfSongs,
 		&i.Hash,
 		&i.Uuid,
+		&i.Fingerprint,
 	)
 	return i, err
 }
 
 const getSoundtrackByUUID = `-- name: GetSoundtrackByUUID :one
-SELECT id, soundtrack_name, added, deleted, last_changed, path, times_played, last_played, number_of_songs, hash, uuid 
+SELECT id, soundtrack_name, added, deleted, last_changed, path, times_played, last_played, number_of_songs, hash, uuid, fingerprint 
 FROM soundtrack 
 WHERE uuid = $1 
 AND deleted IS NULL
@@ -165,6 +168,7 @@ func (q *Queries) GetSoundtrackByUUID(ctx context.Context, argUuid uuid.UUID) (S
 		&i.NumberOfSongs,
 		&i.Hash,
 		&i.Uuid,
+		&i.Fingerprint,
 	)
 	return i, err
 }
@@ -240,6 +244,15 @@ func (q *Queries) InsertSoundtrackWithExistingId(ctx context.Context, arg Insert
 	return err
 }
 
+const markSoundtracksDeletedExcept = `-- name: MarkSoundtracksDeletedExcept :exec
+UPDATE soundtrack SET deleted=now() WHERE deleted IS NULL AND NOT (id = ANY($1::int[]))
+`
+
+func (q *Queries) MarkSoundtracksDeletedExcept(ctx context.Context, ids []int32) error {
+	_, err := q.db.Exec(ctx, markSoundtracksDeletedExcept, ids)
+	return err
+}
+
 const removeSoundtrackDeletionDate = `-- name: RemoveSoundtrackDeletionDate :exec
 UPDATE soundtrack SET deleted=NULL WHERE id=$1
 `
@@ -269,6 +282,20 @@ func (q *Queries) SetSoundtrackDeletionDate(ctx context.Context) error {
 	return err
 }
 
+const setSoundtrackFingerprint = `-- name: SetSoundtrackFingerprint :exec
+UPDATE soundtrack SET fingerprint=$1 WHERE id=$2
+`
+
+type SetSoundtrackFingerprintParams struct {
+	Fingerprint string `json:"fingerprint"`
+	ID          int32  `json:"id"`
+}
+
+func (q *Queries) SetSoundtrackFingerprint(ctx context.Context, arg SetSoundtrackFingerprintParams) error {
+	_, err := q.db.Exec(ctx, setSoundtrackFingerprint, arg.Fingerprint, arg.ID)
+	return err
+}
+
 const updateSoundtrackHash = `-- name: UpdateSoundtrackHash :exec
 UPDATE soundtrack SET hash=$1, last_changed=now() WHERE id=$2
 `