refactor: context propagation, LogAudit deadlock fix, ESLint v9, code quality

- Propagate context.Context from WS upgrade through all 17 handlers
- Add ExecContext/QueryRowContext/QueryContext/BeginTx to DB wrapper
- Fix LogAudit deadlock: move audit writes after tx.Commit to avoid
  SQLite write-lock contention (TestAdminAPI_PatchUser_UnbanUser)
- Add ESLint v9 with no-floating-promises, no-unused-vars
- Refactor livekitSession.ts: remove duplicate audio pipeline (267 lines)
- Add delete account UI tests (7 tests)
- Expand WS integration tests

Server/admin/setup_handler.go

@@ -3,6 +3,7 @@ package admin
 import (
 	"encoding/json"
 	"log/slog"
+	"net"
 	"net/http"
 	"strings"
 	"time"
@@ -63,8 +64,13 @@ func handleSetupStatus(database *db.DB) http.HandlerFunc {
 func handleSetup(database *db.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		// Rate limit: 5 attempts per minute per IP.
-		ip := r.RemoteAddr
-		setupKey := "setup:" + ip
+		// Strip the port so that different source ports from the same IP
+		// are correctly grouped under a single rate-limit bucket.
+		host, _, err := net.SplitHostPort(r.RemoteAddr)
+		if err != nil {
+			host = r.RemoteAddr
+		}
+		setupKey := "setup:" + host
 		if !setupLimiter.Allow(setupKey, 5, time.Minute) {
 			writeErr(w, http.StatusTooManyRequests, "RATE_LIMITED", "too many setup attempts, try again later")
 			return
@@ -93,6 +99,12 @@ func handleSetup(database *db.DB) http.HandlerFunc {
 			return
 		}
 
+		// Validate username format (length, no control/invisible chars).
+		if err := auth.ValidateUsername(req.Username); err != nil {
+			writeErr(w, http.StatusBadRequest, "BAD_REQUEST", err.Error())
+			return
+		}
+
 		if err := auth.ValidatePasswordStrength(req.Password); err != nil {
 			writeErr(w, http.StatusBadRequest, "BAD_REQUEST", err.Error())
 			return
@@ -120,7 +132,7 @@ func handleSetup(database *db.DB) http.HandlerFunc {
 		}
 
 		device := r.Header.Get("User-Agent")
-		if _, err := database.CreateSession(uid, auth.HashToken(token), device, ip); err != nil {
+		if _, err := database.CreateSession(uid, auth.HashToken(token), device, host); err != nil {
 			writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "failed to create session")
 			return
 		}