chore: remaining server changes (code quality, go mod tidy)

Go mod tidy, minor server-side adjustments from security verification
and code quality cleanup pass.

Server/admin/admin.go

@@ -57,6 +57,7 @@ func NewHandler(database *db.DB, version string, hub HubBroadcaster, u *updater.
 }
 
 // Handler returns the admin panel http.Handler using a nil database.
+//
 // Deprecated: use NewHandler instead. Kept for backwards-compat with any
 // caller that already imported this symbol before Phase 6.
 func Handler() http.Handler {

Server/admin/handlers_backup.go

@@ -116,12 +116,12 @@ func handleDeleteBackup(database *db.DB) http.Handler {
 		}
 
 		backupPath := filepath.Join("data", "backups", name)
-		if _, err := os.Stat(backupPath); os.IsNotExist(err) {
+		if _, err := os.Stat(backupPath); os.IsNotExist(err) { //nolint:gosec // G703: path is sanitized above
 			writeErr(w, http.StatusNotFound, "NOT_FOUND", "backup not found")
 			return
 		}
 
-		if err := os.Remove(backupPath); err != nil {
+		if err := os.Remove(backupPath); err != nil { //nolint:gosec // G703: path is sanitized above
 			writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "failed to delete backup")
 			return
 		}
@@ -156,7 +156,7 @@ func handleRestoreBackup(database *db.DB) http.Handler {
 		}
 
 		backupPath := filepath.Join("data", "backups", name)
-		if _, err := os.Stat(backupPath); os.IsNotExist(err) {
+		if _, err := os.Stat(backupPath); os.IsNotExist(err) { //nolint:gosec // G703: path is sanitized above
 			writeErr(w, http.StatusNotFound, "NOT_FOUND", "backup not found")
 			return
 		}
@@ -195,7 +195,7 @@ func handleRestoreBackup(database *db.DB) http.Handler {
 
 // copyFile streams src to dst without loading the entire file into memory.
 func copyFile(src, dst string) error {
-	in, err := os.Open(src)
+	in, err := os.Open(src) //nolint:gosec // G703: src is from sanitized backup path
 	if err != nil {
 		return fmt.Errorf("open source: %w", err)
 	}

Server/admin/handlers_users.go

@@ -37,8 +37,8 @@ func handleListUsers(database *db.DB) http.HandlerFunc {
 		}
 
 		safe := make([]adminUserResponse, len(users))
-		for i, u := range users {
-			safe[i] = toAdminUserResponse(u)
+		for i := range users {
+			safe[i] = toAdminUserResponse(users[i])
 		}
 		writeJSON(w, http.StatusOK, safe)
 	}

Server/admin/helpers.go

@@ -29,7 +29,7 @@ func writeErr(w http.ResponseWriter, status int, code, msg string) {
 	writeJSON(w, status, errorResponse{Error: code, Message: msg})
 }
 
-func pathInt64(r *http.Request, param string) (int64, error) {
+func pathInt64(r *http.Request, param string) (int64, error) { //nolint:unparam // kept generic for future URL params
 	raw := chi.URLParam(r, param)
 	return strconv.ParseInt(raw, 10, 64)
 }

Server/admin/logstream.go

@@ -202,8 +202,8 @@ func NewMultiHandler(stdout slog.Handler, buf *RingBuffer, minLevel slog.Leveler
 	}
 }
 
-func (h *multiHandler) Enabled(_ context.Context, level slog.Level) bool {
-	return h.stdout.Enabled(context.Background(), level) || h.ring.Enabled(level)
+func (h *multiHandler) Enabled(ctx context.Context, level slog.Level) bool {
+	return h.stdout.Enabled(ctx, level) || h.ring.Enabled(level)
 }
 
 func (h *multiHandler) Handle(ctx context.Context, r slog.Record) error {

Server/admin/middleware_and_spawn_test.go

@@ -401,7 +401,7 @@ func (m *mockHubWB) BroadcastChannelUpdate(ch *db.Channel)                  {}
 func (m *mockHubWB) BroadcastChannelDelete(channelID int64)                 {}
 func (m *mockHubWB) BroadcastMemberBan(userID int64)                        {}
 func (m *mockHubWB) BroadcastMemberUpdate(userID int64, roleName string)    {}
-func (m *mockHubWB) ClientCount() int                                        { return 0 }
+func (m *mockHubWB) ClientCount() int                                       { return 0 }
 
 // TestSpawnDetached_ValidExecutable verifies that spawnDetached can start a
 // real executable (the Go test binary itself) with a flag that causes immediate

Server/admin/update_handlers.go

@@ -133,7 +133,7 @@ func handleApplyUpdate(u *updater.Updater, hub HubBroadcaster, _ string) http.Ha
 
 // spawnDetached starts a new process that is not attached to the current one.
 func spawnDetached(exePath string, args []string) error {
-	cmd := exec.Command(exePath, args...)
+	cmd := exec.Command(exePath, args...) //nolint:gosec // G204: command path from trusted server config
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr