chore: remaining server changes (code quality, go mod tidy)

Go mod tidy, minor server-side adjustments from security verification
and code quality cleanup pass.

Server/db/attachment_queries.go

@@ -64,7 +64,7 @@ func (d *DB) LinkAttachmentsToMessage(messageID int64, attachmentIDs []string) (
 		args = append(args, id)
 	}
 
-	query := fmt.Sprintf(
+	query := fmt.Sprintf( //nolint:gosec // G201: placeholder interpolation, not user input
 		`UPDATE attachments SET message_id = ? WHERE id IN (%s) AND message_id IS NULL`,
 		strings.Join(placeholders, ","),
 	)
@@ -88,7 +88,7 @@ func (d *DB) GetAttachmentsByMessageIDs(msgIDs []int64) (map[int64][]AttachmentI
 		args[i] = id
 	}
 
-	query := fmt.Sprintf(
+	query := fmt.Sprintf( //nolint:gosec // G201: placeholder interpolation, not user input
 		`SELECT id, message_id, filename, size, mime_type, width, height
 		 FROM attachments WHERE message_id IN (%s)`,
 		strings.Join(placeholders, ","),

Server/db/channel_queries.go

@@ -219,7 +219,7 @@ func (d *DB) GetChannelTypes(ids []int64) (map[int64]string, error) {
 		args[i] = id
 	}
 
-	query := fmt.Sprintf(
+	query := fmt.Sprintf( //nolint:gosec // G201: placeholder interpolation, not user input
 		`SELECT id, type FROM channels WHERE id IN (%s)`,
 		strings.Join(placeholders, ","),
 	)

Server/db/dm_queries.go

@@ -11,12 +11,12 @@ import (
 
 // DMChannelInfo holds a DM channel summary for the channel list.
 type DMChannelInfo struct {
-	ChannelID     int64   `json:"channel_id"`
-	Recipient     DMUser  `json:"recipient"`
-	LastMessageID *int64  `json:"last_message_id"`
-	LastMessage   string  `json:"last_message"`
-	LastMessageAt string  `json:"last_message_at"`
-	UnreadCount   int     `json:"unread_count"`
+	ChannelID     int64  `json:"channel_id"`
+	Recipient     DMUser `json:"recipient"`
+	LastMessageID *int64 `json:"last_message_id"`
+	LastMessage   string `json:"last_message"`
+	LastMessageAt string `json:"last_message_at"`
+	UnreadCount   int    `json:"unread_count"`
 }
 
 // DMUser is the public-facing shape for a DM participant.

Server/db/message_queries.go

@@ -383,7 +383,7 @@ func (d *DB) getReactionsBatch(msgIDs []int64, requestingUserID int64) (map[int6
 	placeholders := sb.String()
 
 	// Query: aggregate count + check if requesting user reacted.
-	query := fmt.Sprintf(
+	query := fmt.Sprintf( //nolint:gosec // G201: placeholder interpolation, not user input
 		`SELECT r.message_id, r.emoji, COUNT(*) as cnt,
 		        MAX(CASE WHEN r.user_id = ? THEN 1 ELSE 0 END) as me
 		 FROM reactions r

Server/db/migrate.go

@@ -18,6 +18,7 @@ package db
 // filename without executing the SQL, so subsequent runs treat them as done.
 
 import (
+	"database/sql"
 	"fmt"
 	"io/fs"
 	"sort"
@@ -46,8 +47,10 @@ func isExistingDatabase(d *DB) (bool, error) {
 		"SELECT name FROM sqlite_master WHERE type='table' AND name='users'",
 	).Scan(&name)
 	if err != nil {
-		// sql.ErrNoRows means the table does not exist.
-		return false, nil
+		if err == sql.ErrNoRows {
+			return false, nil
+		}
+		return false, fmt.Errorf("isExistingDatabase: %w", err)
 	}
 	return true, nil
 }
@@ -59,7 +62,10 @@ func schemaVersionsExists(d *DB) (bool, error) {
 		"SELECT name FROM sqlite_master WHERE type='table' AND name='schema_versions'",
 	).Scan(&name)
 	if err != nil {
-		return false, nil
+		if err == sql.ErrNoRows {
+			return false, nil
+		}
+		return false, fmt.Errorf("schemaVersionsExists: %w", err)
 	}
 	return true, nil
 }
@@ -71,22 +77,14 @@ func isApplied(d *DB, filename string) (bool, error) {
 		"SELECT version FROM schema_versions WHERE version = ?", filename,
 	).Scan(&v)
 	if err != nil {
-		return false, nil
+		if err == sql.ErrNoRows {
+			return false, nil
+		}
+		return false, fmt.Errorf("isApplied: %w", err)
 	}
 	return true, nil
 }
 
-// recordApplied inserts a migration filename into schema_versions.
-func recordApplied(d *DB, filename string) error {
-	_, err := d.sqlDB.Exec(
-		"INSERT INTO schema_versions (version) VALUES (?)", filename,
-	)
-	if err != nil {
-		return fmt.Errorf("recording migration %s: %w", filename, err)
-	}
-	return nil
-}
-
 // sqlFilenames returns all .sql entries from the FS sorted lexicographically.
 func sqlFilenames(fsys fs.FS) ([]string, error) {
 	entries, err := fs.ReadDir(fsys, ".")