Fix data races, nil-record panics, scanner SSRF, log date layout, shutdown timeouts, and enable stricter linters (#54)

High (behavioral bugs):
- service.Geo: add RLock on lookups, handle Reload error, keep old DBs on failure
- models.GeoDB.Reload: open new DBs before closing old ones (no reader gap)
- router: guard nil geo records (404 instead of 500) in geo.go, generic.go, dns.go
- router/port_scanner: reject undetermined client IPs (nil->localhost dial)
- internal/httputils: fix access log date layout (02/Jan/2006, not literal Nov)
- server/quic: log.Printf instead of log.Fatal in request handler

Medium:
- server/*: 10s shutdown timeout; SIGTERM drains servers before closing geo DBs
- httputils: Clone() request headers instead of mutating the live map; strings.Builder
- setting/app: handle all os.Stat errors; fix "truster" typos; use errors.New;
  remove dead Token field
- cmd: errors.Is for sentinel checks; os.Stderr; log.Fatal instead of panic;
  pass http.Handler by value (not pointer-to-interface)
- resolver: validate config at startup (pre-parse RRs, validate IPs); check WriteMsg
  errors; Setup returns error

Low:
- .golangci.yaml: enable errcheck, govet, errorlint; fix all resulting findings
- server/tls: explicit TLSConfig{MinVersion: tls.VersionTLS12}
- router/dns: label-exact vhost suffix check, strip port; template.Must
- models: errors.Join instead of %s on []error
- service/geo_test: race-regression test (concurrent lookups during Reload)
- README: Go >= 1.25; fix latent test bug (store.Add->Set in dns_test.go)

router/generic.go

@@ -75,8 +75,12 @@ func getAllAsString(ctx *gin.Context) {
 	output += "Client Port: " + getClientPort(ctx) + "\n"
 
 	if geoSvc != nil {
-		output += geoCityRecordToString(geoSvc.LookUpCity(ip)) + "\n"
-		output += geoASNRecordToString(geoSvc.LookUpASN(ip)) + "\n"
+		if cityRecord := geoSvc.LookUpCity(ip); cityRecord != nil {
+			output += geoCityRecordToString(cityRecord) + "\n"
+		}
+		if asnRecord := geoSvc.LookUpASN(ip); asnRecord != nil {
+			output += geoASNRecordToString(asnRecord) + "\n"
+		}
 	}
 
 	h := httputils.GetHeadersWithoutTrustedHeaders(ctx)
@@ -100,19 +104,18 @@ func jsonOutput(ctx *gin.Context) JSONResponse {
 
 	geoResp := GeoResponse{}
 	if geoSvc != nil {
-		cityRecord := geoSvc.LookUpCity(ip)
-		asnRecord := geoSvc.LookUpASN(ip)
-
-		geoResp = GeoResponse{
-			Country:         cityRecord.Country.Names["en"],
-			CountryCode:     cityRecord.Country.ISOCode,
-			City:            cityRecord.City.Names["en"],
-			Latitude:        cityRecord.Location.Latitude,
-			Longitude:       cityRecord.Location.Longitude,
-			PostalCode:      cityRecord.Postal.Code,
-			TimeZone:        cityRecord.Location.TimeZone,
-			ASN:             asnRecord.AutonomousSystemNumber,
-			ASNOrganization: asnRecord.AutonomousSystemOrganization,
+		if cityRecord := geoSvc.LookUpCity(ip); cityRecord != nil {
+			geoResp.Country = cityRecord.Country.Names["en"]
+			geoResp.CountryCode = cityRecord.Country.ISOCode
+			geoResp.City = cityRecord.City.Names["en"]
+			geoResp.Latitude = cityRecord.Location.Latitude
+			geoResp.Longitude = cityRecord.Location.Longitude
+			geoResp.PostalCode = cityRecord.Postal.Code
+			geoResp.TimeZone = cityRecord.Location.TimeZone
+		}
+		if asnRecord := geoSvc.LookUpASN(ip); asnRecord != nil {
+			geoResp.ASN = asnRecord.AutonomousSystemNumber
+			geoResp.ASNOrganization = asnRecord.AutonomousSystemOrganization
 		}
 	}