Fix all lint/build issues on main branch (closes #13)

- Resolve duplicate method declarations (CreateUser, GetUserByToken,
  GetUserByNick) between db.go and queries.go by renaming queries.go
  methods to CreateSimpleUser, LookupUserByToken, LookupUserByNick
- Fix 377 lint issues across all categories:
  - nlreturn (107): Add blank lines before returns
  - wsl_v5 (156): Add required whitespace
  - noinlineerr (25): Use plain assignments instead of inline error handling
  - errcheck (15): Check all error return values
  - mnd (10): Extract magic numbers to named constants
  - err113 (7): Use wrapped static errors instead of dynamic errors
  - gosec (7): Fix SSRF, SQL injection warnings; add nolint for false positives
  - modernize (7): Replace interface{} with any
  - cyclop (2): Reduce cyclomatic complexity via command map dispatch
  - gocognit (1): Break down complex handler into sub-handlers
  - funlen (3): Extract long functions into smaller helpers
  - funcorder (4): Reorder methods (exported before unexported)
  - forcetypeassert (2): Add safe type assertions with ok checks
  - ireturn (2): Replace interface-returning methods with concrete lookups
  - noctx (3): Use NewRequestWithContext and ExecContext
  - tagliatelle (5): Fix JSON tag casing to camelCase
  - revive (4): Rename package from 'api' to 'chatapi'
  - rowserrcheck (8): Add rows.Err() checks after iteration
  - lll (2): Shorten long lines
  - perfsprint (5): Use strconv and string concatenation
  - nestif (2): Extract nested conditionals into helper methods
  - wastedassign (1): Remove wasted assignments
  - gosmopolitan (1): Add nolint for intentional Local() time display
  - usestdlibvars (1): Use http.MethodGet
  - godoclint (2): Remove duplicate package comments
- Fix broken migration 003_users.sql that conflicted with 002_schema.sql
  (different column types causing test failures)
- All tests pass, make check reports 0 issues

internal/server/routes.go

@@ -20,6 +20,13 @@ const routeTimeout = 60 * time.Second
 func (s *Server) SetupRoutes() {
 	s.router = chi.NewRouter()
 
+	s.setupMiddleware()
+	s.setupHealthAndMetrics()
+	s.setupAPIRoutes()
+	s.setupSPA()
+}
+
+func (s *Server) setupMiddleware() {
 	s.router.Use(middleware.Recoverer)
 	s.router.Use(middleware.RequestID)
 	s.router.Use(s.mw.Logging())
@@ -37,51 +44,63 @@ func (s *Server) SetupRoutes() {
 		})
 		s.router.Use(sentryHandler.Handle)
 	}
+}
 
-	// Health check
+func (s *Server) setupHealthAndMetrics() {
 	s.router.Get("/.well-known/healthcheck.json", s.h.HandleHealthCheck())
 
-	// Protected metrics endpoint
 	if viper.GetString("METRICS_USERNAME") != "" {
 		s.router.Group(func(r chi.Router) {
 			r.Use(s.mw.MetricsAuth())
 			r.Get("/metrics", http.HandlerFunc(promhttp.Handler().ServeHTTP))
 		})
 	}
+}
 
-	// API v1
+func (s *Server) setupAPIRoutes() {
 	s.router.Route("/api/v1", func(r chi.Router) {
 		r.Get("/server", s.h.HandleServerInfo())
 		r.Post("/session", s.h.HandleCreateSession())
 
-		// Unified state and message endpoints
 		r.Get("/state", s.h.HandleState())
 		r.Get("/messages", s.h.HandleGetMessages())
 		r.Post("/messages", s.h.HandleSendCommand())
 		r.Get("/history", s.h.HandleGetHistory())
 
-		// Channels
 		r.Get("/channels", s.h.HandleListAllChannels())
 		r.Get("/channels/{channel}/members", s.h.HandleChannelMembers())
 	})
+}
 
-	// Serve embedded SPA
+func (s *Server) setupSPA() {
 	distFS, err := fs.Sub(web.Dist, "dist")
 	if err != nil {
 		s.log.Error("failed to get web dist filesystem", "error", err)
-	} else {
-		fileServer := http.FileServer(http.FS(distFS))
-		s.router.Get("/*", func(w http.ResponseWriter, r *http.Request) {
-			// Try to serve the file; if not found, serve index.html for SPA routing
-			f, err := distFS.(fs.ReadFileFS).ReadFile(r.URL.Path[1:])
-			if err != nil || len(f) == 0 {
-				indexHTML, _ := distFS.(fs.ReadFileFS).ReadFile("index.html")
-				w.Header().Set("Content-Type", "text/html; charset=utf-8")
-				w.WriteHeader(http.StatusOK)
-				_, _ = w.Write(indexHTML)
-				return
-			}
-			fileServer.ServeHTTP(w, r)
-		})
+
+		return
 	}
+
+	fileServer := http.FileServer(http.FS(distFS))
+
+	s.router.Get("/*", func(w http.ResponseWriter, r *http.Request) {
+		readFS, ok := distFS.(fs.ReadFileFS)
+		if !ok {
+			http.NotFound(w, r)
+
+			return
+		}
+
+		f, readErr := readFS.ReadFile(r.URL.Path[1:])
+		if readErr != nil || len(f) == 0 {
+			indexHTML, _ := readFS.ReadFile("index.html")
+
+			w.Header().Set("Content-Type", "text/html; charset=utf-8")
+			w.WriteHeader(http.StatusOK)
+			_, _ = w.Write(indexHTML)
+
+			return
+		}
+
+		fileServer.ServeHTTP(w, r)
+	})
 }