fix: resolve 5 remaining medium/low issues from third-pass go-review

- NEW-1: Add rows.Err() check in ListMembers to catch cursor errors
- NEW-2: Add minVal parameter to queryInt so offset=0 is not rejected
- NEW-3: Fix copyFile double-close by removing defer, using explicit
  close on both success and error paths
- NEW-4: Add GetAllChannelPermissionsForRole batch query, eliminating
  N+1 GetChannelPermissions calls in channel list and search handlers
- NEW-5: Cap fetchBody with io.LimitReader(1 MiB) to prevent memory
  exhaustion from malformed release assets

Server/updater/updater.go

@@ -296,7 +296,9 @@ func (u *Updater) fetchBody(ctx context.Context, url string) ([]byte, error) {
 		return nil, fmt.Errorf("HTTP %d fetching %s", resp.StatusCode, url)
 	}
 
-	return io.ReadAll(resp.Body)
+	// Cap reads at 1 MiB — checksum and signature files are tiny text;
+	// this prevents a malicious or corrupted release asset from exhausting memory.
+	return io.ReadAll(io.LimitReader(resp.Body, 1<<20))
 }
 
 // FindClientAssets scans the cached release assets for the Tauri NSIS