Track possible hardening and correctness improvements

[raeperd]

This issue tracks possible improvements found during a codebase review. It is a backlog item, not a decision to implement everything now.

Current checks pass:

• go test -race ./...
• golangci-lint run
• Coverage: ~80.7%

Suggested order by impact:

1. Debug endpoints exposure

   • /debug/pprof/* and /debug/vars are currently enabled by default.
   • For this small template project, this may be acceptable as-is.
   • If this template is used in production, consider documenting the tradeoff or making debug routes opt-in.

2. Avoid leaking panic details to clients

   • recovery currently returns the panic value in the 500 response.
   • Prefer a generic client response like internal server error while keeping the full error and stack in logs.

3. Add stronger server timeouts

   • ReadHeaderTimeout is set.
   • Consider adding ReadTimeout, WriteTimeout, and IdleTimeout as safer defaults.

4. Preserve http.ErrAbortHandler behavior

   • recovery currently swallows http.ErrAbortHandler.
   • Better to re-panic it so net/http can abort the connection as intended.

5. Fix responseRecorder correctness

   • Empty successful responses are logged with status 0 instead of 200.
   • Multiple WriteHeader calls can overwrite the first status.
   • Byte count should track actual written bytes, not only len(b).

6. Emit access logs for panic responses

   • Current middleware order can skip access logs when a panic happens.
   • Consider changing middleware order or using a deferred access log.

7. Run Docker image as non-root

   • Add USER 65532:65532 or similar in the runtime image.

8. Avoid global logger mutation

   • slog.SetDefault changes process-wide state.
   • Prefer creating a logger and passing it explicitly.

9. Align Docker image names

   • Makefile: ghcr.io/raeperd/kickstart
   • GitHub Actions: ghcr.io/${{ github.repository }}
   • Pick one name to avoid confusion.

10. Improve test robustness

    • Avoid free-port-then-close race in TestMain.
    • Fail explicitly if readiness check never succeeds.
    • Close response bodies in all readiness-loop paths.

11. Dockerfile polish

    • Use AS instead of as.
    • Prefer ENTRYPOINT ["/bin/app"].
    • Add .dockerignore for app, coverage.txt, and temporary files.