后端与全仓代码质量清理（golangci 扩展集 · 测试质量 · 并发安全 · 文档同步）

代码质量全量清理，零行为变化：golangci 扩展集 13 类 linter（gosec/modernize/perfsprint/canonicalheader/usestdlibvars/wastedassign/intrange/errorlint/forcetypeassert/recvcheck/exhaustive/unparam）全量修复，测试代码质量（testifylint/thelper/usetesting）25→0，frpc 进程生命周期真 bug（进程组击杀）、全仓 go test -race 6 类数据竞争（含 1 个生产竞争）、SPDX license 头补齐 131 文件、前端测试套件 next-intl 迁移后 44 失败→全绿、过期 swagger 文档重新生成、pnpm-workspace 构建审批。

Experiments: #2-#17, #18, #20, #21, #23
Metric: total_issues 108 → 8 (-92.6%)

internal/apps/relay/config/config.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 // Package config loads and persists relay daemon configuration.
 package config
 

internal/apps/relay/config/version.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 package config
 
 // Version is the relay daemon build version string.

internal/apps/relay/frps/manager.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 // Package frps manages the lifecycle of the frps reverse-proxy process:
 // rendering its TOML config, supervising the child process with exponential-
 // backoff restarts, and exposing runtime status to the heartbeat subsystem.
@@ -240,7 +243,7 @@ func (m *Manager) supervise(ctx context.Context, generation uint64) {
 			continue
 		}
 
-		_ = os.WriteFile(m.pidPath, []byte(fmt.Sprintf("%d", cmd.Process.Pid)), frpsPidFilePerm)
+		_ = os.WriteFile(m.pidPath, fmt.Appendf(nil, "%d", cmd.Process.Pid), frpsPidFilePerm)
 
 		m.cmd = cmd
 		m.status = "healthy"

internal/apps/relay/frps/manager_test.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 package frps
 
 import (
@@ -7,7 +10,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"strings"
-	"sync/atomic"
+	"syscall"
 	"testing"
 	"time"
 
@@ -16,6 +19,7 @@ import (
 
 // Helper to write control file for the dummy script
 func writeControl(t *testing.T, dir string, exitCode int, delaySeconds int) {
+	t.Helper()
 	controlPath := filepath.Join(dir, "control.txt")
 	content := fmt.Sprintf("%d %d\n", exitCode, delaySeconds)
 	err := os.WriteFile(controlPath, []byte(content), 0644)
@@ -26,6 +30,7 @@ func writeControl(t *testing.T, dir string, exitCode int, delaySeconds int) {
 
 // Setup a dummy executable script that reads control.txt to decide exit code and sleep duration
 func setupDummyScript(t *testing.T) (string, string) {
+	t.Helper()
 	dir := t.TempDir()
 	scriptPath := filepath.Join(dir, "dummy_frps")
 
@@ -53,6 +58,7 @@ exit "${EXIT_CODE:-0}"
 
 // Helper to poll for status to eliminate timing flakiness in tests
 func assertStatusEventually(t *testing.T, m *Manager, expectedStatus string, timeout time.Duration) {
+	t.Helper()
 	if timeout < 6*time.Second {
 		timeout = 6 * time.Second
 	}
@@ -304,17 +310,17 @@ func TestSupervisorGenerationInterrupt(t *testing.T) {
 		t.Error("expected old process killed and new command started")
 	}
 
-	// Verify old process is actually killed
-	var cmd1Finished int32
-	go func() {
-		_ = cmd1.Wait()
-		atomic.StoreInt32(&cmd1Finished, 1)
-	}()
-
-	time.Sleep(200 * time.Millisecond)
-	if atomic.LoadInt32(&cmd1Finished) != 1 {
-		t.Error("expected first process to be killed")
+	// Verify old process is actually killed：不要对受管 Cmd 调用 Wait（旧 supervise
+	// goroutine 拥有 Wait 权，并发 Wait 会与 os/exec 内部状态竞争），改为探测
+	// 进程是否已被收割（Signal(0) 在 Wait 后即报错）。
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		if err := cmd1.Process.Signal(syscall.Signal(0)); err != nil {
+			return
+		}
+		time.Sleep(20 * time.Millisecond)
 	}
+	t.Error("expected first process to be killed")
 }
 
 func TestUpdateConfigKillsOrphanProcessBeforeRestart(t *testing.T) {

internal/apps/relay/heartbeat/service.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 // Package heartbeat sends periodic relay node status to the control plane.
 package heartbeat
 

internal/apps/relay/httpclient/client.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 // Package httpclient provides an HTTP client for relay control-plane communication.
 package httpclient
 

internal/apps/relay/observability/collector.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 // Package observability collects relay node profile data for heartbeat reporting.
 package observability
 

internal/apps/relay/relay/runner.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 // Package relay implements the relay node daemon runtime loop.
 package relay
 

internal/apps/relay/state/store.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 // Package state persists relay runtime state to disk.
 package state
 

internal/apps/relay/updater/updater.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 // Package updater provides relay self-update integration with the edge updater.
 package updater
 

internal/apps/relay/wsclient/client.go

@@ -1,3 +1,6 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
 // Package wsclient provides a WebSocket client for relay control-plane communication.
 package wsclient