chore: strict-server codegen, CI improvements, remove auto-assign

[koinsaari]

Summary

• Switch oapi-codegen to strict-server mode — handlers receive typed request objects and return typed response objects, no manual json.Decoder/json.Encoder
• Track internal/gen/api.gen.go in git and remove it from .dockerignore so the repo is self-contained and Docker builds work without a codegen step
• Add .claudeignore to skip indexing large generated files and go.sum (saves context tokens)
• Add codegen-check CI job that regenerates the spec and fails if internal/gen/ drifts
• Bump setup-go to v6.4.0 (SHA-pinned) across all CI jobs — supersedes Dependabot PR chore(deps): bump actions/setup-go from 5.5.0 to 6.4.0 #8
• Remove auto-assign workflow — fired on every PR edit including title changes, not useful for a small team

Test plan

• CI passes (test, lint, codegen-check, docker-build, gitleaks)
• Dependabot PR chore(deps): bump actions/setup-go from 5.5.0 to 6.4.0 #8 (setup-go bump) can be closed as redundant after this merges

🤖 Generated with Claude Code

[claude]

Claude encountered an error —— View job

---

PR Review

• Read REVIEW.md and CLAUDE.md
• Analyze changed files
• Post review findings

---

No blocking issues. This is a clean, incremental setup for strict-server codegen.

Checked:

• No internal/auth → internal/clients/jellyfin import cycle introduced
• No JWT keyfunc changes
• No SQL query changes
• No new API routes requiring handler tests (the strict StrictServerInterface is generated but not yet wired up — main.go still uses a bare http.NewServeMux — which is intentional for an incremental rollout)

---

🟡 Nits (2)

1. go-chi/chi/v5 indirect dependency (go.mod:17)

chi/v5 was added as // indirect. The generated file (api.gen.go) doesn't import it directly — this dependency is pulled in transitively through the oapi-codegen tool declaration. That's fine, but worth confirming with go mod tidy that it stays after the tool is invoked, so future tidy runs don't silently drop it and break a build once chi is actually imported.

2. codegen-check job has no explicit tool-build step (.github/workflows/ci.yml:65–68)

- name: Regenerate and check for drift
  run: |
    make gen
    git diff --exit-code internal/gen/

setup-go@v6 caches modules, so go tool oapi-codegen will typically be served from cache. On a cold cache the first run will build the tool from source, which can add ~30–60 s. Not a problem, just something to be aware of if the job feels slow on the first PR after a cache eviction.

Fix this →

---

Summary: Both findings are minor. State is success.

[claude]

Claude encountered an error —— View job

---

PR Review

• Read REVIEW.md and CLAUDE.md
• Analyze changed files
• Post review findings

---

No blocking issues. This is a clean, well-structured codegen setup.

Checked:

• No internal/auth → internal/clients/jellyfin import cycle introduced
• JWT keyfunc at internal/auth/jwt.go:37 correctly validates signing method before returning key (unchanged by this PR)
• No SQL query changes
• No new API routes requiring handler tests — StrictServerInterface is generated but main.go still wires only http.NewServeMux, which is the right incremental approach

Notes on previous review findings:

The previous review flagged go-chi/chi/v5 as an indirect dependency — this was incorrect. chi does not appear in go.mod and the generated file (internal/gen/api.gen.go) only imports github.com/getkin/kin-openapi/openapi3 as an external dependency alongside stdlib. No chi dependency to worry about.

The previous review's cold-cache concern for codegen-check is already addressed: go mod download is present before make gen (ci.yml:67), so module sources are fetched before the tool is compiled.

---

Summary: No findings. State is success.