Restructure backend into services and fix security, crash and sync issues

Security
- Serve character images through os.Root so names like ../ can't escape
  the characters folder
- Sync start and /sync/reset are POST only (legacy and /api/v1)
- /api/v1/token/cleanup requires a token, password compared in constant
  time, tokens no longer logged
- Echo's rate limiter replaces the custom one; TRUSTED_PROXIES enables
  X-Forwarded-For for reverse proxies

Crashes and races
- Sync state lives in SyncService with atomics and a mutex instead of
  unsynchronised globals (fixes concurrent map writes during full sync)
- Only one sync can run; /api/v1 sync and music routes are locked during
  sync like the legacy ones
- No log.Fatal outside startup: errors become 4xx/5xx responses
- Search uses an in-order character match instead of unescaped regexes
- Empty queue / no songs return 404 instead of panicking or looping

Behaviour
- Sync result is computed once and stays the same between polls
- Swagger and /openapi serve the embedded spec
- Shutdown stops HTTP before closing the database
- Expired tokens are deleted with a context that outlives the request
- Files are served with Range support and correct content types; audio
  has no write deadline

Performance
- Migration 000006 adds soundtrack.fingerprint (names, sizes, mtimes) so
  unchanged folders are skipped without reading any files
- Songs are reconciled per soundtrack with one query plus needed writes;
  renames keep play counts
- Moved MUSIC_PATH updates soundtrack and song paths
- .id cleanup only runs for changed soundtracks or a full sync
- Classic random uses one SQL query; Gitea release lookups are cached
  with a timeout

Structure
- internal/config reads all environment variables once
- sqlc emits a Querier interface; backend globals become services
  injected into handlers
- One route registration shared by legacy and /api/v1
- Removed dead code (dbHelper.go, unused middleware, duplicate Gitea
  functions, embedded Swagger UI copy) and lib/pq
- templ and swag pinned as go tools

internal/server/files.go

@@ -0,0 +1,61 @@
+package server
+
+import (
+	"errors"
+	"net/http"
+	"os"
+	"path/filepath"
+	"time"
+
+	"music-server/internal/backend"
+	"music-server/internal/logging"
+
+	"github.com/labstack/echo/v5"
+	"go.uber.org/zap"
+)
+
+// serveFile sends a file with support for Range requests and caching headers.
+// contentType may be empty to detect it from the file extension.
+func serveFile(c *echo.Context, f *os.File, contentType string) error {
+	defer f.Close()
+	info, err := f.Stat()
+	if err != nil {
+		return err
+	}
+	if info.IsDir() {
+		return echo.NewHTTPError(http.StatusNotFound, "Not Found")
+	}
+	if contentType != "" {
+		c.Response().Header().Set(echo.HeaderContentType, contentType)
+	}
+	http.ServeContent(c.Response(), c.Request(), filepath.Base(f.Name()), info.ModTime(), f)
+	return nil
+}
+
+// serveSong streams a song. The write deadline is lifted because songs can take long to send to slow clients.
+func serveSong(c *echo.Context, path string, err error) error {
+	if err != nil {
+		return songError(err)
+	}
+	f, err := os.Open(path)
+	if err != nil {
+		return echo.NewHTTPError(http.StatusNotFound, "Not Found")
+	}
+	_ = http.NewResponseController(c.Response()).SetWriteDeadline(time.Time{})
+	return serveFile(c, f, "audio/mpeg")
+}
+
+// songError maps backend errors to HTTP errors.
+func songError(err error) error {
+	switch {
+	case errors.Is(err, backend.ErrQueueEmpty), errors.Is(err, backend.ErrNoSongs), errors.Is(err, backend.ErrNotFound):
+		return echo.NewHTTPError(http.StatusNotFound, err.Error())
+	case errors.Is(err, backend.ErrInvalidName):
+		return echo.NewHTTPError(http.StatusBadRequest, err.Error())
+	case errors.Is(err, backend.ErrUpstream):
+		return echo.NewHTTPError(http.StatusBadGateway, err.Error())
+	default:
+		logging.GetLogger().Error("Request failed", zap.Error(err))
+		return echo.NewHTTPError(http.StatusInternalServerError, "Internal Server Error")
+	}
+}