fix: add golangci config, restore CI timeouts, svelte-check warnings, RespondError helper

backend/handlers/auth/local.go

@@ -86,7 +86,7 @@ func RegisterHandler(w http.ResponseWriter, r *http.Request) {
 
 	// Must accept terms
 	if !req.AgreedToPolicy {
-		http.Error(w, "must agree to terms", http.StatusBadRequest)
+		mw.RespondError(w, http.StatusBadRequest, "must agree to terms")
 		return
 	}
 
@@ -105,11 +105,11 @@ func RegisterHandler(w http.ResponseWriter, r *http.Request) {
 
 	// Password must not exceed bcrypt's 72-byte limit
 	if len(req.Password) > 72 {
-		http.Error(w, "password must be 72 characters or less", http.StatusBadRequest)
+		mw.RespondError(w, http.StatusBadRequest, "password must be 72 characters or less")
 		return
 	}
 	if len(req.Password) < 6 {
-		http.Error(w, "password must be at least 6 characters", http.StatusBadRequest)
+		mw.RespondError(w, http.StatusBadRequest, "password must be at least 6 characters")
 		return
 	}
 	// Server-side password strength check using the same @zxcvbn-ts/core as the frontend
@@ -353,13 +353,13 @@ func LoginHandler(w http.ResponseWriter, r *http.Request) {
 	loginStateMu.Lock()
 	if t, ok := loginInProgress[userID]; ok && time.Since(t) < 30*time.Second {
 		loginStateMu.Unlock()
-		http.Error(w, "login already in progress", http.StatusConflict) // 409
+		mw.RespondError(w, http.StatusConflict, "login already in progress")
 		return
 	}
 	// Cap the map size - drop new request if at capacity
 	if len(loginInProgress) >= maxLoginInProgress {
 		loginStateMu.Unlock()
-		http.Error(w, "server busy, try again later", http.StatusTooManyRequests)
+		mw.RespondError(w, http.StatusTooManyRequests, "server busy, try again later")
 		return
 	}
 	loginInProgress[userID] = clock.Now()
@@ -429,7 +429,7 @@ func LoginHandler(w http.ResponseWriter, r *http.Request) {
 	tx, err := db.Conn.Begin(r.Context())
 	if err != nil {
 		log.Printf("Failed to begin transaction: %v", err)
-		http.Error(w, "Internal server error", http.StatusInternalServerError)
+		mw.RespondError(w, http.StatusInternalServerError, "internal server error")
 		return
 	}
 	defer func() {
@@ -497,7 +497,7 @@ func RefreshTokenHandler(w http.ResponseWriter, r *http.Request) {
 	// Generate new token
 	newToken, jti, err := auth.GenerateToken(userID, currentRole)
 	if err != nil {
-		http.Error(w, "could not generate token", http.StatusInternalServerError)
+		mw.RespondError(w, http.StatusInternalServerError, "could not generate token")
 		return
 	}
 
@@ -518,7 +518,7 @@ func LogoutHandler(w http.ResponseWriter, r *http.Request) {
 	// Revoke the JTI — match the access token lifetime (1 hour)
 	if err := auth.RevokeJTI(r.Context(), jti, clock.Now().Add(1*time.Hour)); err != nil {
 		slog.Error("logout: failed to revoke JTI", "err", err)
-		http.Error(w, "Failed to revoke token. Please try again.", http.StatusInternalServerError)
+		mw.RespondError(w, http.StatusInternalServerError, "failed to revoke token. please try again.")
 		return
 	}