H-300: wire Captain Skills into Web runtime (#48)

* H-300: wire Captain Skills into Web runtime

* H-300: enforce effective model and conservative skill budget

* H-300: fix CI gosec step

* ci: extend golangci-lint timeout

* fix lint findings across backend

* fix(push): resolve delivery protocol blockers

* test(repository): close SQLite test databases

* test(repository): reuse SQLite schema per package

* H-307: restore backend Go cache in CI

* H-307: prefetch modules before cold lint

* H-307: resolve govulncheck security gate

* H-307: build lint with patched Go toolchain

* H-307: clear remaining security scan findings

---------

Co-authored-by: Rogee <rogee@ipao.vip>

backend/internal/handler/api/v1/auth_handler.go

@@ -3,7 +3,6 @@ package v1
 import (
 	crypto_rand "crypto/rand"
 	"fmt"
-	math_rand "math/rand"
 	"net/http"
 	"strconv"
 	"strings"
@@ -11,6 +10,7 @@ import (
 	"github.com/gin-gonic/gin"
 
 	"github.com/gochat/gochat/internal/service"
+	applogger "github.com/gochat/gochat/pkg/logger"
 	"github.com/gochat/gochat/pkg/response"
 )
 
@@ -278,9 +278,11 @@ func (h *AuthHandler) ResetPassword(c *gin.Context) {
 	}
 
 	// Always return success even if email doesn't exist (security best practice)
-	h.authService.ResetPassword(c.Request.Context(), &service.ResetPasswordInput{
+	if err := h.authService.ResetPassword(c.Request.Context(), &service.ResetPasswordInput{
 		Email: req.Email,
-	})
+	}); err != nil {
+		applogger.L().Warnf("reset password request failed: %v", err)
+	}
 
 	c.JSON(http.StatusOK, gin.H{"message": service.ChatwootPasswordResetMessage})
 }
@@ -449,9 +451,7 @@ func generateOAuthState() string {
 func randomHex(n int) string {
 	b := make([]byte, n)
 	if _, err := crypto_rand.Read(b); err != nil {
-		// Fallback: math/rand should never be reached in production,
-		// but prevents a panic if /dev/urandom is temporarily unavailable.
-		math_rand.Read(b)
+		panic(fmt.Sprintf("generate OAuth state: %v", err))
 	}
 	return fmt.Sprintf("%x", b)
 }