后端与全仓代码质量清理（golangci 扩展集 · 测试质量 · 并发安全 · 文档同步）

代码质量全量清理，零行为变化：golangci 扩展集 13 类 linter（gosec/modernize/perfsprint/canonicalheader/usestdlibvars/wastedassign/intrange/errorlint/forcetypeassert/recvcheck/exhaustive/unparam）全量修复，测试代码质量（testifylint/thelper/usetesting）25→0，frpc 进程生命周期真 bug（进程组击杀）、全仓 go test -race 6 类数据竞争（含 1 个生产竞争）、SPDX license 头补齐 131 文件、前端测试套件 next-intl 迁移后 44 失败→全绿、过期 swagger 文档重新生成、pnpm-workspace 构建审批。

Experiments: #2-#17, #18, #20, #21, #23
Metric: total_issues 108 → 8 (-92.6%)

internal/apps/edge/config/duration.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 // Package config provides shared configuration types for edge applications.
 package config
 

internal/apps/edge/config/duration_test.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 package config
 
 import (

internal/apps/edge/heartbeat/autoupdate.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 // Package heartbeat handles periodic heartbeat and update checks.
 package heartbeat
 

internal/apps/edge/heartbeat/loop.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 package heartbeat
 
 import (

internal/apps/edge/heartbeat/loop_test.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 package heartbeat
 
 import (

internal/apps/edge/httpclient/client.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 // Package httpclient provides an authenticated HTTP client for edge services.
 package httpclient
 

internal/apps/edge/logging/logging.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 // Package logging configures structured logging for edge applications.
 package logging
 

internal/apps/edge/nodeip/nodeip.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 // Package nodeip detects the preferred public IP address for edge nodes.
 package nodeip
 

internal/apps/edge/observability/linux.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 // Package observability provides helpers that read Linux /proc and /sys metrics for system monitoring.
 package observability
 
@@ -96,10 +99,7 @@ func ReadMemInfo() (int64, int64) {
 	if total == 0 {
 		return 0, 0
 	}
-	used := total - (memAvailableKB * 1024)
-	if used < 0 {
-		used = 0
-	}
+	used := max(total-(memAvailableKB*1024), 0)
 	return total, used
 }
 
@@ -138,8 +138,8 @@ func ReadLinuxCPUStat() (uint64, uint64) {
 	if err != nil {
 		return 0, 0
 	}
-	lines := strings.Split(string(content), "\n")
-	for _, line := range lines {
+	lines := strings.SplitSeq(string(content), "\n")
+	for line := range lines {
 		if !strings.HasPrefix(line, "cpu ") {
 			continue
 		}
@@ -258,23 +258,23 @@ func StatFilesystem(path string) (int64, int64) {
 	if err := syscall.Statfs(absPath, &stat); err != nil {
 		return 0, 0
 	}
-	total := multiplyUint64ToInt64(stat.Blocks, uint64(stat.Bsize))
-	free := multiplyUint64ToInt64(stat.Bavail, uint64(stat.Bsize))
-	used := total - free
-	if used < 0 {
-		used = 0
-	}
+	total := multiplyUint64Int64(stat.Blocks, stat.Bsize)
+	free := multiplyUint64Int64(stat.Bavail, stat.Bsize)
+	used := max(total-free, 0)
 	return total, used
 }
 
-func multiplyUint64ToInt64(a uint64, b uint64) int64 {
-	if a == 0 || b == 0 {
+// multiplyUint64Int64 multiplies a uint64 by a positive int64, saturating at
+// math.MaxInt64 to avoid int64 overflow.
+func multiplyUint64Int64(a uint64, b int64) int64 {
+	if a == 0 || b <= 0 {
 		return 0
 	}
-	if a > math.MaxInt64/b {
+	v := a * uint64(b)
+	if v > math.MaxInt64 {
 		return math.MaxInt64
 	}
-	return int64(a * b) //nolint:gosec // product is bounded to math.MaxInt64 above
+	return int64(v)
 }
 
 // ReadFirstLine reads and returns the trimmed first line of a file.

internal/apps/edge/observability/linux_test.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 package observability
 
 import (

internal/apps/edge/runner/wsreconnect.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 // Package runner provides shared WebSocket reconnect helpers for edge daemons.
 package runner
 

internal/apps/edge/updater/restart_unix.go

@@ -1,9 +1,13 @@
 //go:build !windows
 
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 // Package updater provides capabilities to check for, download, and apply updates.
 package updater
 
 import (
+	"errors"
 	"fmt"
 	"log/slog"
 	"os"
@@ -19,7 +23,7 @@ func replaceAndRestart(execPath string, tmpPath string) error {
 		renameErr := err
 		if err := os.Remove(tmpPath); err != nil && !os.IsNotExist(err) {
 			slog.Error("remove tmp binary failed", "path", tmpPath, "error", err)
-			return fmt.Errorf("backup current binary: %w; remove tmp binary: %v", renameErr, err)
+			return fmt.Errorf("backup current binary: %w; remove tmp binary: %w", renameErr, err)
 		}
 		return fmt.Errorf("backup current binary: %w", renameErr)
 	}
@@ -27,7 +31,7 @@ func replaceAndRestart(execPath string, tmpPath string) error {
 		replaceErr := err
 		if err := os.Rename(backupPath, execPath); err != nil {
 			slog.Error("restore backup binary failed", "path", backupPath, "error", err)
-			return fmt.Errorf("replace binary: %w; restore backup binary: %v", replaceErr, err)
+			return fmt.Errorf("replace binary: %w; restore backup binary: %w", replaceErr, err)
 		}
 		return fmt.Errorf("replace binary: %w", replaceErr)
 	}
@@ -37,7 +41,7 @@ func replaceAndRestart(execPath string, tmpPath string) error {
 	if err := syscall.Exec(execPath, os.Args, os.Environ()); err != nil { //nolint:gosec // execPath is the validated edge updater binary path
 		return fmt.Errorf("exec restart: %w", err)
 	}
-	return fmt.Errorf("unreachable after exec")
+	return errors.New("unreachable after exec")
 }
 
 func removeBackupBinary(path string) error {

internal/apps/edge/updater/restart_unix_test.go

@@ -1,5 +1,8 @@
 //go:build !windows
 
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 package updater
 
 import (

internal/apps/edge/updater/restart_windows.go

@@ -1,5 +1,8 @@
 //go:build windows
 
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 package updater
 
 import (

internal/apps/edge/updater/service.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 // Package updater provides capabilities to check for, download, and apply updates.
 package updater
 
@@ -6,6 +9,7 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"log/slog"
@@ -285,7 +289,7 @@ func (s *Service) downloadChecksum(ctx context.Context, url string, assetName st
 
 func parseSHA256Checksum(content string, assetName string) (string, error) {
 	assetName = strings.TrimSpace(assetName)
-	for _, line := range strings.Split(content, "\n") {
+	for line := range strings.SplitSeq(content, "\n") {
 		line = strings.TrimSpace(line)
 		if line == "" || strings.HasPrefix(line, "#") {
 			continue
@@ -295,7 +299,7 @@ func parseSHA256Checksum(content string, assetName string) (string, error) {
 		}
 	}
 	if assetName == "" {
-		return "", fmt.Errorf("checksum asset does not contain a valid sha256 digest")
+		return "", errors.New("checksum asset does not contain a valid sha256 digest")
 	}
 	return "", fmt.Errorf("checksum asset does not contain a sha256 digest for %q", assetName)
 }
@@ -340,7 +344,7 @@ func isSHA256Hex(value string) bool {
 func (s *Service) downloadAndRestart(ctx context.Context, url string, expectedChecksum string, targetPath string) error {
 	expectedChecksum = strings.ToLower(strings.TrimSpace(expectedChecksum))
 	if !isSHA256Hex(expectedChecksum) {
-		return fmt.Errorf("invalid expected sha256 checksum")
+		return errors.New("invalid expected sha256 checksum")
 	}
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {

internal/apps/edge/updater/service_test.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 package updater
 
 import (

internal/apps/edge/wsclient/client.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 // Package wsclient provides WebSocket client abstractions for edge node communication.
 package wsclient
 

internal/apps/edge/wsclient/client_test.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 package wsclient
 
 import (