Restructure backend into services and fix security, crash and sync issues

Security
- Serve character images through os.Root so names like ../ can't escape
  the characters folder
- Sync start and /sync/reset are POST only (legacy and /api/v1)
- /api/v1/token/cleanup requires a token, password compared in constant
  time, tokens no longer logged
- Echo's rate limiter replaces the custom one; TRUSTED_PROXIES enables
  X-Forwarded-For for reverse proxies

Crashes and races
- Sync state lives in SyncService with atomics and a mutex instead of
  unsynchronised globals (fixes concurrent map writes during full sync)
- Only one sync can run; /api/v1 sync and music routes are locked during
  sync like the legacy ones
- No log.Fatal outside startup: errors become 4xx/5xx responses
- Search uses an in-order character match instead of unescaped regexes
- Empty queue / no songs return 404 instead of panicking or looping

Behaviour
- Sync result is computed once and stays the same between polls
- Swagger and /openapi serve the embedded spec
- Shutdown stops HTTP before closing the database
- Expired tokens are deleted with a context that outlives the request
- Files are served with Range support and correct content types; audio
  has no write deadline

Performance
- Migration 000006 adds soundtrack.fingerprint (names, sizes, mtimes) so
  unchanged folders are skipped without reading any files
- Songs are reconciled per soundtrack with one query plus needed writes;
  renames keep play counts
- Moved MUSIC_PATH updates soundtrack and song paths
- .id cleanup only runs for changed soundtracks or a full sync
- Classic random uses one SQL query; Gitea release lookups are cached
  with a timeout

Structure
- internal/config reads all environment variables once
- sqlc emits a Querier interface; backend globals become services
  injected into handlers
- One route registration shared by legacy and /api/v1
- Removed dead code (dbHelper.go, unused middleware, duplicate Gitea
  functions, embedded Swagger UI copy) and lib/pq
- templ and swag pinned as go tools

internal/server/sync_handler.go

@@ -0,0 +1,80 @@
+package server
+
+import (
+	"net/http"
+
+	"music-server/internal/backend"
+	"music-server/internal/logging"
+
+	"github.com/labstack/echo/v5"
+)
+
+type SyncHandler struct {
+	sync *backend.SyncService
+}
+
+func NewSyncHandler(sync *backend.SyncService) *SyncHandler {
+	return &SyncHandler{sync: sync}
+}
+
+// SyncProgress godoc
+// @Summary Get sync progress
+// @Description Returns the progress of the running sync, or the result of the last sync
+// @Tags sync
+// @Produce json
+// @Success 200 {object} backend.SyncResponse
+// @Router /sync/progress [get]
+func (s *SyncHandler) SyncProgress(ctx *echo.Context) error {
+	if s.sync.IsSyncing() {
+		return ctx.JSON(http.StatusOK, s.sync.Progress())
+	}
+	return ctx.JSON(http.StatusOK, s.sync.Result())
+}
+
+// SyncSoundtracksNewOnlyChanges godoc
+// @Summary Sync soundtracks with only changes
+// @Description Starts syncing soundtracks that have changed
+// @Tags sync
+// @Produce json
+// @Success 200 {string} string "Start syncing soundtracks"
+// @Failure 423 {string} string "Syncing is in progress"
+// @Router /sync [post]
+func (s *SyncHandler) SyncSoundtracksNewOnlyChanges(ctx *echo.Context) error {
+	return s.start(ctx, false, "Start syncing soundtracks")
+}
+
+// SyncSoundtracksNewFull godoc
+// @Summary Sync all soundtracks fully
+// @Description Starts a full sync of all soundtracks
+// @Tags sync
+// @Produce json
+// @Success 200 {string} string "Start syncing soundtracks full"
+// @Failure 423 {string} string "Syncing is in progress"
+// @Router /sync/full [post]
+func (s *SyncHandler) SyncSoundtracksNewFull(ctx *echo.Context) error {
+	return s.start(ctx, true, "Start syncing soundtracks full")
+}
+
+func (s *SyncHandler) start(ctx *echo.Context, full bool, message string) error {
+	if !s.sync.Start(full) {
+		return ctx.JSON(http.StatusLocked, "Syncing is in progress")
+	}
+	logging.GetLogger().Info(message)
+	return ctx.JSON(http.StatusOK, message)
+}
+
+// ResetDB godoc
+// @Summary Reset soundtracks database
+// @Description Resets the soundtracks database by deleting all soundtracks and songs
+// @Tags sync
+// @Produce json
+// @Success 200 {string} string "Soundtracks and songs are deleted from the database"
+// @Failure 423 {string} string "Syncing is in progress"
+// @Router /sync/reset [post]
+func (s *SyncHandler) ResetDB(ctx *echo.Context) error {
+	logging.GetLogger().Info("Resetting soundtracks database")
+	if err := s.sync.ResetDB(ctx.Request().Context()); err != nil {
+		return songError(err)
+	}
+	return ctx.JSON(http.StatusOK, "Soundtracks and songs are deleted from the database")
+}