fix: code quality, memory safety, and install improvements

Critical fixes:
- Fix Dockerfile: reorder stages so frontend assets embed into Go binary
- Fix Go version 1.25 (nonexistent) to 1.24 across Dockerfile, go.mod, CI
- Add graceful game server shutdown on SIGTERM/SIGINT
- Order startup tasks: updates complete before auto-start
- Fix TOCTOU race in UpdateSettings with atomic Update() method

Security:
- Add optional AUTH_TOKEN bearer auth middleware on API/WS routes
- Fix path traversal in DeleteMod using filepath.Rel instead of HasPrefix
- Add input validation for IPPort, ServerParameters, ScheduledUpdate

Memory safety:
- Cap RPT buffer allocation to 64KB to prevent OOM on large logs
- Cap GetLog file read to 10MB
- Fix context cancel leak in SteamCmdManager.run()
- Remove data-raced cancel field in steamcmd.go
- Atomic file writes (write-temp-then-rename) across all managers

Reliability:
- Log save errors in ProcessManager.Stop()
- Atomic file writes prevent corruption on crash

Tests:
- Add mod_manager_test.go (12 tests: ListWorkshopMods, ListLocalMods,
  BuildUsageMap, RemoveMod, dirSize)
- Add scheduler_test.go (6 tests: Start/Stop, Refresh with empty,
  invalid, valid, and replaced cron expressions)
- Add TestRestart to server_process_test.go

CI/Docs:
- Add -race flag to go test in CI and Makefile
- Add npm lint step to CI
- Add Go/npm module caching to CI
- Update README: prerequisites, AUTH_TOKEN/GIN_MODE/SERVERS_DIR docs,
  fix manual quickstart to use make build

backend/internal/api/settings.go

@@ -1,9 +1,15 @@
 package api
 
 import (
+	"fmt"
+	"net"
 	"net/http"
+	"strings"
+
+	"arma3-web-server/internal/models"
 
 	"github.com/gin-gonic/gin"
+	"github.com/robfig/cron/v3"
 )
 
 type updateSettingsInput struct {
@@ -39,65 +45,86 @@ func (h *Handler) UpdateSettings(c *gin.Context) {
 		return
 	}
 
-	s, err := h.settings.Load()
+	if input.IPPort != nil && *input.IPPort != "" {
+		if _, _, err := net.SplitHostPort(*input.IPPort); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("invalid ip_port: must be host:port format: %v", err)})
+			return
+		}
+	}
+	if input.ServerParameters != nil && len(*input.ServerParameters) > 8192 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "server_parameters too long (max 8192)"})
+		return
+	}
+	if input.ScheduledUpdate != nil && *input.ScheduledUpdate != "" {
+		parser := cron.NewParser(cron.Minute | cron.Hour | cron.Dom | cron.Month | cron.Dow)
+		if _, err := parser.Parse(*input.ScheduledUpdate); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("invalid cron expression: %v", err)})
+			return
+		}
+	}
+	if input.ServerParameters != nil {
+		for _, forbidden := range []string{"--dry-run", "--rm", "--privileged"} {
+			if strings.Contains(*input.ServerParameters, forbidden) {
+				c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("server_parameters contains forbidden flag: %s", forbidden)})
+				return
+			}
+		}
+	}
+
+	s, err := h.settings.Update(func(s *models.ServerSettings) {
+		if input.IPPort != nil {
+			s.IPPort = *input.IPPort
+		}
+		if input.ServerParameters != nil {
+			s.ServerParameters = *input.ServerParameters
+		}
+		if input.SteamBranch != nil {
+			s.SteamBranch = *input.SteamBranch
+		}
+		if input.SteamUser != nil {
+			s.SteamUser = *input.SteamUser
+		}
+		if input.Platform != nil {
+			s.Platform = *input.Platform
+		}
+		if input.CBASettings != nil {
+			s.CBASettings = *input.CBASettings
+		}
+		if input.AILevelPresets != nil {
+			s.AILevelPresets = *input.AILevelPresets
+		}
+		if input.DifficultyPresets != nil {
+			s.DifficultyPresets = *input.DifficultyPresets
+		}
+		if input.ActiveConfig != nil {
+			s.ActiveConfig = *input.ActiveConfig
+		}
+		if input.ActiveModlist != nil {
+			s.ActiveModlist = *input.ActiveModlist
+		}
+		if input.AutoUpdateOnStartup != nil {
+			s.AutoUpdateOnStartup = *input.AutoUpdateOnStartup
+		}
+		if input.AutoStartOnStartup != nil {
+			s.AutoStartOnStartup = *input.AutoStartOnStartup
+		}
+		if input.AutoUpdateModsOnStartup != nil {
+			s.AutoUpdateModsOnStartup = *input.AutoUpdateModsOnStartup
+		}
+		if input.ScheduledUpdate != nil {
+			s.ScheduledUpdate = *input.ScheduledUpdate
+		}
+	})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
 
-	if input.IPPort != nil {
-		s.IPPort = *input.IPPort
-	}
-	if input.ServerParameters != nil {
-		s.ServerParameters = *input.ServerParameters
-	}
-	if input.SteamBranch != nil {
-		s.SteamBranch = *input.SteamBranch
-	}
-	if input.SteamUser != nil {
-		s.SteamUser = *input.SteamUser
-	}
-	if input.Platform != nil {
-		s.Platform = *input.Platform
-	}
-	if input.CBASettings != nil {
-		s.CBASettings = *input.CBASettings
-	}
-	if input.AILevelPresets != nil {
-		s.AILevelPresets = *input.AILevelPresets
-	}
-	if input.DifficultyPresets != nil {
-		s.DifficultyPresets = *input.DifficultyPresets
-	}
-	if input.ActiveConfig != nil {
-		s.ActiveConfig = *input.ActiveConfig
-	}
-	if input.ActiveModlist != nil {
-		s.ActiveModlist = *input.ActiveModlist
-	}
-	if input.AutoUpdateOnStartup != nil {
-		s.AutoUpdateOnStartup = *input.AutoUpdateOnStartup
-	}
-	if input.AutoStartOnStartup != nil {
-		s.AutoStartOnStartup = *input.AutoStartOnStartup
-	}
-	if input.AutoUpdateModsOnStartup != nil {
-		s.AutoUpdateModsOnStartup = *input.AutoUpdateModsOnStartup
-	}
-	if input.ScheduledUpdate != nil {
-		s.ScheduledUpdate = *input.ScheduledUpdate
-	}
-
 	if err := h.process.WriteUserconfigFiles(s); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "write userconfig: " + err.Error()})
 		return
 	}
 
-	if err := h.settings.Save(s); err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
-		return
-	}
-
 	if h.scheduler != nil {
 		h.scheduler.Refresh()
 	}