Fix data races, nil-record panics, scanner SSRF, log date layout, shutdown timeouts, and enable stricter linters (#54)

High (behavioral bugs):
- service.Geo: add RLock on lookups, handle Reload error, keep old DBs on failure
- models.GeoDB.Reload: open new DBs before closing old ones (no reader gap)
- router: guard nil geo records (404 instead of 500) in geo.go, generic.go, dns.go
- router/port_scanner: reject undetermined client IPs (nil->localhost dial)
- internal/httputils: fix access log date layout (02/Jan/2006, not literal Nov)
- server/quic: log.Printf instead of log.Fatal in request handler

Medium:
- server/*: 10s shutdown timeout; SIGTERM drains servers before closing geo DBs
- httputils: Clone() request headers instead of mutating the live map; strings.Builder
- setting/app: handle all os.Stat errors; fix "truster" typos; use errors.New;
  remove dead Token field
- cmd: errors.Is for sentinel checks; os.Stderr; log.Fatal instead of panic;
  pass http.Handler by value (not pointer-to-interface)
- resolver: validate config at startup (pre-parse RRs, validate IPs); check WriteMsg
  errors; Setup returns error

Low:
- .golangci.yaml: enable errcheck, govet, errorlint; fix all resulting findings
- server/tls: explicit TLSConfig{MinVersion: tls.VersionTLS12}
- router/dns: label-exact vhost suffix check, strip port; template.Must
- models: errors.Join instead of %s on []error
- service/geo_test: race-regression test (concurrent lookups during Reload)
- README: Go >= 1.25; fix latent test bug (store.Add->Set in dns_test.go)

cmd/whatismyip.go

@@ -2,8 +2,10 @@ package main
 
 import (
 	"context"
+	"errors"
 	"flag"
 	"fmt"
+	"log"
 	"net/http"
 	"os"
 	"slices"
@@ -25,11 +27,11 @@ import (
 func main() {
 	o, err := setting.Setup(os.Args[1:])
 	if err != nil {
-		if err == flag.ErrHelp || err == setting.ErrVersion {
+		if errors.Is(err, flag.ErrHelp) || errors.Is(err, setting.ErrVersion) {
 			fmt.Print(o)
 			os.Exit(0)
 		}
-		fmt.Println(err)
+		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
 
@@ -38,7 +40,10 @@ func main() {
 
 	if setting.App.Resolver.Domain != "" {
 		store := cache.New(1*time.Minute, 10*time.Minute)
-		dnsEngine := resolver.Setup(store)
+		var dnsEngine *resolver.Resolver
+		if dnsEngine, err = resolver.Setup(store); err != nil {
+			log.Fatalf("Invalid resolver configuration: %s", err)
+		}
 		nameServer := server.NewDNSServer(context.Background(), dnsEngine.Handler())
 		servers = append(servers, nameServer)
 		engine.Use(router.GetDNSDiscoveryHandler(store, setting.App.Resolver.Domain, setting.App.Resolver.RedirectPort))
@@ -47,7 +52,7 @@ func main() {
 	var geoSvc *service.Geo
 	if setting.App.GeodbPath.City != "" || setting.App.GeodbPath.ASN != "" {
 		if geoSvc, err = service.NewGeo(context.Background(), setting.App.GeodbPath.City, setting.App.GeodbPath.ASN); err != nil {
-			panic(err)
+			log.Fatalf("Failed to load geo databases: %s", err)
 		}
 	}
 
@@ -92,12 +97,12 @@ func setupHTTPServers(ctx context.Context, handler http.Handler) []server.Server
 	var servers []server.Server
 
 	if setting.App.BindAddress != "" {
-		tcpServer := server.NewTCPServer(ctx, &handler)
+		tcpServer := server.NewTCPServer(ctx, handler)
 		servers = append(servers, tcpServer)
 	}
 
 	if setting.App.TLSAddress != "" {
-		tlsServer := server.NewTLSServer(ctx, &handler)
+		tlsServer := server.NewTLSServer(ctx, handler)
 		servers = append(servers, tlsServer)
 		if setting.App.EnableHTTP3 {
 			quicServer := server.NewQuicServer(ctx, tlsServer)