fix: code quality, memory safety, and install improvements

Critical fixes:
- Fix Dockerfile: reorder stages so frontend assets embed into Go binary
- Fix Go version 1.25 (nonexistent) to 1.24 across Dockerfile, go.mod, CI
- Add graceful game server shutdown on SIGTERM/SIGINT
- Order startup tasks: updates complete before auto-start
- Fix TOCTOU race in UpdateSettings with atomic Update() method

Security:
- Add optional AUTH_TOKEN bearer auth middleware on API/WS routes
- Fix path traversal in DeleteMod using filepath.Rel instead of HasPrefix
- Add input validation for IPPort, ServerParameters, ScheduledUpdate

Memory safety:
- Cap RPT buffer allocation to 64KB to prevent OOM on large logs
- Cap GetLog file read to 10MB
- Fix context cancel leak in SteamCmdManager.run()
- Remove data-raced cancel field in steamcmd.go
- Atomic file writes (write-temp-then-rename) across all managers

Reliability:
- Log save errors in ProcessManager.Stop()
- Atomic file writes prevent corruption on crash

Tests:
- Add mod_manager_test.go (12 tests: ListWorkshopMods, ListLocalMods,
  BuildUsageMap, RemoveMod, dirSize)
- Add scheduler_test.go (6 tests: Start/Stop, Refresh with empty,
  invalid, valid, and replaced cron expressions)
- Add TestRestart to server_process_test.go

CI/Docs:
- Add -race flag to go test in CI and Makefile
- Add npm lint step to CI
- Add Go/npm module caching to CI
- Update README: prerequisites, AUTH_TOKEN/GIN_MODE/SERVERS_DIR docs,
  fix manual quickstart to use make build

README.md

@@ -24,18 +24,22 @@ The web UI is served on `http://localhost:8080`.
 
 ### Manual
 
-```bash
-# Backend
-cd backend
-go build -o arma3-web-server ./cmd/server
-./arma3-web-server
+**Prerequisites:**
+- [Go](https://go.dev/dl/) >= 1.24
+- [Node.js](https://nodejs.org/) >= 22 with npm
+- GNU Make (optional, for `make` targets)
 
-# Frontend (development)
-cd frontend
-npm install
-npm run dev
+```bash
+# Build for production (frontend + backend in one binary)
+make build
+./backend/arma3-web-server
+
+# Or develop with hot reload (uses test stubs, no real SteamCMD needed)
+make dev
 ```
 
+The web UI is served on `http://localhost:8080`.
+
 ## Configuration
 
 All paths are configurable via environment variables:
@@ -51,6 +55,9 @@ All paths are configurable via environment variables:
 | `SERVER_BINARY` | `arma3server_x64` | Server binary filename (overrides platform default) |
 | `SERVER_PARAMS` | `-server -world=empty ...` | Override server launch parameters |
 | `STEAMCMD_PATH` | `steamcmd` | Path to steamcmd binary |
+| `AUTH_TOKEN` | _(empty)_ | Bearer token for API/WS auth. When set, all requests must include `Authorization: Bearer <token>`. When empty, no auth required. |
+| `GIN_MODE` | `debug` | Gin framework mode. Use `release` for production (set automatically in Docker). |
+| `SERVERS_DIR` | `./serverfiles` | Docker Compose only: host directory mounted as `/servers` in the container. |
 
 ## Automation
 
@@ -66,7 +73,7 @@ Configured in the **Automation** section of the Settings UI:
 | **Auto-update mods on startup** | Downloads workshop updates for every enabled mod in the active modlist when the web service starts. |
 | **Auto-start server on startup** | Restarts the game server if it was running when the web service last stopped. Useful for recovery after host backup cycles or container restarts. |
 
-All startup tasks run asynchronously — the web UI is available immediately.
+All startup tasks run asynchronously — the web UI is available immediately. Server and mod updates run in parallel; auto-start waits for both to complete before launching the game server.
 
 ### Scheduled updates