feat: add syncutil mutex, test scaffolding, and server hardening

- Add syncutil package with deadlock-detecting mutex (build-tag switchable)
- Add main_test.go TestMain scaffolding across all server packages
- Harden concurrency in ws, admin, auth, and updater packages
- Update CI workflow, go.mod/sum, Cargo.lock, and root changelogen tooling

Server/auth/main_test.go

@@ -0,0 +1,11 @@
+package auth_test
+
+import (
+	"testing"
+
+	"go.uber.org/goleak"
+)
+
+func TestMain(m *testing.M) {
+	goleak.VerifyTestMain(m)
+}

Server/auth/ratelimit.go

@@ -1,8 +1,9 @@
 package auth
 
 import (
-	"sync"
 	"time"
+
+	"github.com/owncord/server/syncutil"
 )
 
 // entry records individual request timestamps for sliding-window limiting.
@@ -18,7 +19,7 @@ type lockoutEntry struct {
 // RateLimiter is an in-memory, thread-safe sliding-window rate limiter with
 // optional IP lockout support.
 type RateLimiter struct {
-	mu       sync.Mutex
+	mu       syncutil.Mutex
 	windows  map[string]*entry
 	lockouts map[string]*lockoutEntry
 }

Server/auth/totp.go

@@ -11,8 +11,9 @@ import (
 	"fmt"
 	"net/url"
 	"strings"
-	"sync"
 	"time"
+
+	"github.com/owncord/server/syncutil"
 )
 
 const (
@@ -31,13 +32,13 @@ type PartialAuthChallenge struct {
 }
 
 type PartialAuthStore struct {
-	mu      sync.Mutex
+	mu      syncutil.Mutex
 	entries map[string]PartialAuthChallenge
 	ttl     time.Duration
 }
 
 type PendingTOTPStore struct {
-	mu      sync.Mutex
+	mu      syncutil.Mutex
 	entries map[int64]pendingTOTPEnrollment
 	ttl     time.Duration
 }
@@ -164,7 +165,7 @@ func (s *PendingTOTPStore) cleanupExpiredLocked() {
 // UsedTOTPCodeStore tracks recently verified TOTP codes to prevent replay
 // attacks within the ±1 period validity window (~90 seconds).
 type UsedTOTPCodeStore struct {
-	mu      sync.Mutex
+	mu      syncutil.Mutex
 	entries map[string]time.Time // key: "userID:code" → expiry
 }