fix: code quality, memory safety, and install improvements

Critical fixes:
- Fix Dockerfile: reorder stages so frontend assets embed into Go binary
- Fix Go version 1.25 (nonexistent) to 1.24 across Dockerfile, go.mod, CI
- Add graceful game server shutdown on SIGTERM/SIGINT
- Order startup tasks: updates complete before auto-start
- Fix TOCTOU race in UpdateSettings with atomic Update() method

Security:
- Add optional AUTH_TOKEN bearer auth middleware on API/WS routes
- Fix path traversal in DeleteMod using filepath.Rel instead of HasPrefix
- Add input validation for IPPort, ServerParameters, ScheduledUpdate

Memory safety:
- Cap RPT buffer allocation to 64KB to prevent OOM on large logs
- Cap GetLog file read to 10MB
- Fix context cancel leak in SteamCmdManager.run()
- Remove data-raced cancel field in steamcmd.go
- Atomic file writes (write-temp-then-rename) across all managers

Reliability:
- Log save errors in ProcessManager.Stop()
- Atomic file writes prevent corruption on crash

Tests:
- Add mod_manager_test.go (12 tests: ListWorkshopMods, ListLocalMods,
  BuildUsageMap, RemoveMod, dirSize)
- Add scheduler_test.go (6 tests: Start/Stop, Refresh with empty,
  invalid, valid, and replaced cron expressions)
- Add TestRestart to server_process_test.go

CI/Docs:
- Add -race flag to go test in CI and Makefile
- Add npm lint step to CI
- Add Go/npm module caching to CI
- Update README: prerequisites, AUTH_TOKEN/GIN_MODE/SERVERS_DIR docs,
  fix manual quickstart to use make build

backend/internal/services/settings.go

@@ -10,6 +10,29 @@ import (
 	"arma3-web-server/internal/models"
 )
 
+func writeFileAtomic(path string, data []byte) error {
+	dir := filepath.Dir(path)
+	tmp, err := os.CreateTemp(dir, ".tmp-*")
+	if err != nil {
+		return err
+	}
+	tmpPath := tmp.Name()
+	if _, err := tmp.Write(data); err != nil {
+		tmp.Close()
+		os.Remove(tmpPath)
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		os.Remove(tmpPath)
+		return err
+	}
+	if err := os.Rename(tmpPath, path); err != nil {
+		os.Remove(tmpPath)
+		return err
+	}
+	return nil
+}
+
 type SettingsManager struct {
 	path string
 	mu   sync.Mutex
@@ -49,7 +72,45 @@ func (sm *SettingsManager) Save(s *models.ServerSettings) error {
 	if err != nil {
 		return err
 	}
-	return os.WriteFile(sm.path, data, 0644)
+	return writeFileAtomic(sm.path, data)
+}
+
+func (sm *SettingsManager) Update(fn func(*models.ServerSettings)) (*models.ServerSettings, error) {
+	sm.mu.Lock()
+	defer sm.mu.Unlock()
+
+	data, err := os.ReadFile(sm.path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			s := sm.defaults()
+			fn(s)
+			s.UpdatedAt = time.Now().UTC()
+			out, err := json.MarshalIndent(s, "", "  ")
+			if err != nil {
+				return nil, err
+			}
+			if err := writeFileAtomic(sm.path, out); err != nil {
+				return nil, err
+			}
+			return s, nil
+		}
+		return nil, err
+	}
+
+	var s models.ServerSettings
+	if err := json.Unmarshal(data, &s); err != nil {
+		return nil, err
+	}
+	fn(&s)
+	s.UpdatedAt = time.Now().UTC()
+	out, err := json.MarshalIndent(s, "", "  ")
+	if err != nil {
+		return nil, err
+	}
+	if err := writeFileAtomic(sm.path, out); err != nil {
+		return nil, err
+	}
+	return &s, nil
 }
 
 func (sm *SettingsManager) defaults() *models.ServerSettings {