refactor: clean up handlers, add input validation, remove raw SQL from handlers

- Merge fanOut/fanOutDirect into single fanOut method
- Move channel lookup to db.GetChannelByName
- Add regex validation for nicks and channel names
- Split HandleSendCommand into per-command helper methods
- Add charset to Content-Type header
- Add sentinel error for unauthorized
- Cap history limit to 500
- Skip NICK change if new == old
- Add empty command check

internal/handlers/handlers.go

@@ -4,6 +4,7 @@ package handlers
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"log/slog"
 	"net/http"
 
@@ -16,6 +17,8 @@ import (
 	"go.uber.org/fx"
 )
 
+var errUnauthorized = errors.New("unauthorized")
+
 // Params defines the dependencies for creating Handlers.
 type Params struct {
 	fx.In
@@ -53,12 +56,11 @@ func New(lc fx.Lifecycle, params Params) (*Handlers, error) {
 }
 
 func (s *Handlers) respondJSON(w http.ResponseWriter, _ *http.Request, data any, status int) {
-	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
 	w.WriteHeader(status)
 
 	if data != nil {
-		err := json.NewEncoder(w).Encode(data)
-		if err != nil {
+		if err := json.NewEncoder(w).Encode(data); err != nil {
 			s.log.Error("json encode error", "error", err)
 		}
 	}