后端与全仓代码质量清理（golangci 扩展集 · 测试质量 · 并发安全 · 文档同步）

代码质量全量清理，零行为变化：golangci 扩展集 13 类 linter（gosec/modernize/perfsprint/canonicalheader/usestdlibvars/wastedassign/intrange/errorlint/forcetypeassert/recvcheck/exhaustive/unparam）全量修复，测试代码质量（testifylint/thelper/usetesting）25→0，frpc 进程生命周期真 bug（进程组击杀）、全仓 go test -race 6 类数据竞争（含 1 个生产竞争）、SPDX license 头补齐 131 文件、前端测试套件 next-intl 迁移后 44 失败→全绿、过期 swagger 文档重新生成、pnpm-workspace 构建审批。

Experiments: #2-#17, #18, #20, #21, #23
Metric: total_issues 108 → 8 (-92.6%)

internal/apps/openflare/waf/graph_validate.go

@@ -12,6 +12,7 @@ import (
 	"io"
 	"net/netip"
 	"regexp"
+	"slices"
 	"strings"
 )
 
@@ -67,7 +68,7 @@ func validateRuleGraphLimits(graph RuleGraph) error {
 	if raw, err := json.Marshal(graph); err != nil {
 		return fmt.Errorf("规则图无法序列化: %w", err)
 	} else if len(raw) > maxRuleGraphBytes {
-		return fmt.Errorf("规则图大小不能超过 256 KiB")
+		return errors.New("规则图大小不能超过 256 KiB")
 	}
 	return nil
 }
@@ -374,12 +375,7 @@ func decodeStrictConfig(raw json.RawMessage, dst any) error {
 }
 
 func validSourceHandle(t RuleNodeType, handle string) bool {
-	for _, expected := range requiredHandles(t) {
-		if handle == expected {
-			return true
-		}
-	}
-	return false
+	return slices.Contains(requiredHandles(t), handle)
 }
 func requiredHandles(t RuleNodeType) []string {
 	switch t {
@@ -387,6 +383,8 @@ func requiredHandles(t RuleNodeType) []string {
 		return []string{"next"}
 	case RuleNodeIPMatch, RuleNodeGeoMatch, RuleNodeUACheck, RuleNodeSecurityCheck:
 		return []string{"true", "false"}
+	case RuleNodeAllow, RuleNodeBlock:
+		return nil
 	default:
 		return nil
 	}