后端与全仓代码质量清理（golangci 扩展集 · 测试质量 · 并发安全 · 文档同步）

代码质量全量清理，零行为变化：golangci 扩展集 13 类 linter（gosec/modernize/perfsprint/canonicalheader/usestdlibvars/wastedassign/intrange/errorlint/forcetypeassert/recvcheck/exhaustive/unparam）全量修复，测试代码质量（testifylint/thelper/usetesting）25→0，frpc 进程生命周期真 bug（进程组击杀）、全仓 go test -race 6 类数据竞争（含 1 个生产竞争）、SPDX license 头补齐 131 文件、前端测试套件 next-intl 迁移后 44 失败→全绿、过期 swagger 文档重新生成、pnpm-workspace 构建审批。

Experiments: #2-#17, #18, #20, #21, #23
Metric: total_issues 108 → 8 (-92.6%)

internal/apps/openflare/relay/logics.go

@@ -5,6 +5,7 @@ package relay
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 	"time"
@@ -20,7 +21,7 @@ const nodeStatusOnline = "online"
 // Heartbeat processes a relay heartbeat, updates node status, and returns config.
 func Heartbeat(ctx context.Context, node *model.OpenFlareNode, payload HeartbeatPayload) (*HeartbeatResponse, error) {
 	if node == nil {
-		return nil, fmt.Errorf("relay node is nil")
+		return nil, errors.New("relay node is nil")
 	}
 
 	payload.Version = strings.TrimSpace(payload.Version)

internal/apps/openflare/relay/logics_test.go

@@ -117,7 +117,7 @@ func TestHeartbeatPayloadBindingAndFrpsObservationInsert(t *testing.T) {
 	snapshots, err := repository.ListOpenFlareMetricSnapshotsSince(ctx, node.NodeID, now.Add(-time.Minute), 10)
 	require.NoError(t, err)
 	require.Len(t, snapshots, 1)
-	assert.Equal(t, 12.5, snapshots[0].CPUUsagePercent)
+	assert.InDelta(t, 12.5, snapshots[0].CPUUsagePercent, 1e-9)
 
 	frpsObs, err := repository.ListOpenFlareNodeObservationFrps(ctx, node.NodeID, time.Time{}, 1)
 	require.NoError(t, err)

internal/apps/openflare/relay/routers.go

@@ -38,7 +38,11 @@ func PostHeartbeat(c *gin.Context) {
 		response.AbortUnauthorized(c, errAgentTokenInvalid)
 		return
 	}
-	node := authNode.(*model.OpenFlareNode)
+	node, ok := authNode.(*model.OpenFlareNode)
+	if !ok {
+		response.AbortUnauthorized(c, errAgentTokenInvalid)
+		return
+	}
 
 	result, err := Heartbeat(c.Request.Context(), node, payload)
 	if apiutil.AbortBadRequestOnError(c, err) {
@@ -61,6 +65,10 @@ func GetWebSocket(c *gin.Context) {
 		response.AbortUnauthorized(c, errAgentTokenInvalid)
 		return
 	}
-	node := authNode.(*model.OpenFlareNode)
+	node, ok := authNode.(*model.OpenFlareNode)
+	if !ok {
+		response.AbortUnauthorized(c, errAgentTokenInvalid)
+		return
+	}
 	ofws.ServeRelay(c, node.NodeID)
 }