fix: code quality, memory safety, and install improvements

Critical fixes:
- Fix Dockerfile: reorder stages so frontend assets embed into Go binary
- Fix Go version 1.25 (nonexistent) to 1.24 across Dockerfile, go.mod, CI
- Add graceful game server shutdown on SIGTERM/SIGINT
- Order startup tasks: updates complete before auto-start
- Fix TOCTOU race in UpdateSettings with atomic Update() method

Security:
- Add optional AUTH_TOKEN bearer auth middleware on API/WS routes
- Fix path traversal in DeleteMod using filepath.Rel instead of HasPrefix
- Add input validation for IPPort, ServerParameters, ScheduledUpdate

Memory safety:
- Cap RPT buffer allocation to 64KB to prevent OOM on large logs
- Cap GetLog file read to 10MB
- Fix context cancel leak in SteamCmdManager.run()
- Remove data-raced cancel field in steamcmd.go
- Atomic file writes (write-temp-then-rename) across all managers

Reliability:
- Log save errors in ProcessManager.Stop()
- Atomic file writes prevent corruption on crash

Tests:
- Add mod_manager_test.go (12 tests: ListWorkshopMods, ListLocalMods,
  BuildUsageMap, RemoveMod, dirSize)
- Add scheduler_test.go (6 tests: Start/Stop, Refresh with empty,
  invalid, valid, and replaced cron expressions)
- Add TestRestart to server_process_test.go

CI/Docs:
- Add -race flag to go test in CI and Makefile
- Add npm lint step to CI
- Add Go/npm module caching to CI
- Update README: prerequisites, AUTH_TOKEN/GIN_MODE/SERVERS_DIR docs,
  fix manual quickstart to use make build

backend/cmd/server/main.go

@@ -10,6 +10,7 @@ import (
 	"os/signal"
 	"path/filepath"
 	"strings"
+	"sync"
 	"syscall"
 	"time"
 
@@ -91,8 +92,12 @@ func main() {
 	if err != nil {
 		log.Printf("startup: load settings: %v", err)
 	} else {
+		var updatesWg sync.WaitGroup
+
 		if s.AutoUpdateOnStartup && s.SteamUser != "" {
+			updatesWg.Add(1)
 			go func() {
+				defer updatesWg.Done()
 				log.Print("startup: auto-updating gameserver")
 				if err := steamcmd.UpdateGame(s.SteamBranch, s.SteamUser); err != nil {
 					log.Printf("startup: auto-update game failed: %v", err)
@@ -101,7 +106,9 @@ func main() {
 		}
 
 		if s.AutoUpdateModsOnStartup && s.ActiveModlist != "" {
+			updatesWg.Add(1)
 			go func() {
+				defer updatesWg.Done()
 				log.Print("startup: auto-updating mods")
 				ml, err := modlistMgr.Get(s.ActiveModlist)
 				if err != nil {
@@ -124,6 +131,7 @@ func main() {
 
 		if s.AutoStartOnStartup && s.WasRunning {
 			go func() {
+				updatesWg.Wait()
 				log.Print("startup: auto-restarting server (was running before)")
 				if err := process.Start(); err != nil {
 					log.Printf("startup: auto-start failed: %v", err)
@@ -152,6 +160,13 @@ func main() {
 	log.Print("shutting down server...")
 	scheduler.Stop()
 
+	if process.IsRunning() {
+		log.Print("stopping game server...")
+		if err := process.Stop(); err != nil {
+			log.Printf("stop game server: %v", err)
+		}
+	}
+
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 	if err := srv.Shutdown(ctx); err != nil {