Overhaul regression testing: e2e suite, fuzzing, CI, and bug fixes

Add a protocol-level end-to-end suite (in-process fully wired server on
an ephemeral port pair, driven by hotline.Client over TCP) covering
handshake, login, public and private chat, message board, threaded
news, file list/download/upload, account admin, disconnect
notification, and shutdown broadcast. The harness retries on a fresh
port pair when another process steals a probed port before
ListenAndServe binds it, and Server gains WithConnectionRateLimit so
tests can disable the per-IP connection throttle.

Add native fuzz tests for Transaction, Field, and flattened file
object decoding, and fix the bugs the new tests surfaced:

- Transaction.Write panicked on out-of-range attacker-controlled size
  fields, and transactionScanner's uint32 length addition could wrap
  and yield a truncated token. The information fork size declared in
  an untrusted fork header is now bounded too.
- Client keepalive read c.done unsynchronized while Disconnect
  replaces it under the mutex.
- The shared Agreement's Seek+ReadAll login path raced concurrent
  logins; the server now prefers an AgreementBytes() snapshot.

Fill unit-test gaps (main's config-copy helpers, file resume data,
ReloaderFunc, R2 error injection and env validation) and add a CI test
workflow (build/vet + race-enabled shuffled suite), fixed lint
workflow triggers with golangci-lint v2.6, and Makefile test/cover/
lint/fuzz targets.

1 files changed, 22 insertions, 0 deletions

diff --git a/Makefile b/Makefile
index 54a8631..6e0e236 100644
--- a/Makefile
+++ b/Makefile
@@ -1,2 +1,24 @@
 server:
 	go build -ldflags "-X main.version=$$(git describe --exact-match --tags || echo "dev" ) -X main.commit=$$(git rev-parse --short HEAD)" -o mobius-hotline-server cmd/mobius-hotline-server/main.go
+
+.PHONY: test
+test:
+	go test ./... -race -shuffle=on
+
+.PHONY: cover
+cover:
+	go test ./... -race -shuffle=on -coverprofile=coverage.out -covermode=atomic
+	go tool cover -html=coverage.out
+
+.PHONY: lint
+lint:
+	golangci-lint run
+
+# Run each fuzz target for FUZZTIME (default 30s). Plain `go test` already replays
+# committed seed corpora; this exercises new random inputs.
+.PHONY: fuzz
+fuzz:
+	@for target in $$(go test ./hotline -list 'Fuzz.*' | grep '^Fuzz'); do \
+		echo "fuzzing $$target"; \
+		go test ./hotline -run '^$$' -fuzz "^$$target$$" -fuzztime $${FUZZTIME:-30s} || exit 1; \
+	done