Phase 2b: server/client timeouts, atomic state writes, log mutex, panic and shutdown fixes

- http.Server with ReadHeaderTimeout/IdleTimeout (no read/write timeouts: /stream/ is long-lived)
- shared outbound clients: providerHTTPClient (5m), apiHTTPClient (30s), imgcache client (30s)
- imgcache: download outside the lock, per-item helper, cache URL uses the file name not the fs path
- writeFileAtomic (temp + fsync + rename) for settings/xepg/pms/urls/authentication JSON
- one package-level logMu for WebScreenLog and notifications; ring buffer keeps the newest lines
- notifications evict the oldest instead of random map entries
- xepg XMLTV file removal rebuilt after the loop; data.go range-mutation removed
- API handler returns after error body; WS request/response fresh per command
- checked type assertions in data/backup/provider/screen
- SIGINT/SIGTERM handled in main via src.Shutdown(); fatal paths exit 1

src/internal/authentication/atomic_test.go

@@ -0,0 +1,43 @@
+package authentication
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestWriteFileAtomic(t *testing.T) {
+	dir := t.TempDir()
+	file := filepath.Join(dir, "authentication.json")
+
+	if err := writeFileAtomic(file, []byte("{\"a\":1}"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := writeFileAtomic(file, []byte("{\"a\":2}"), 0600); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := os.ReadFile(file)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got) != "{\"a\":2}" {
+		t.Errorf("content = %q", got)
+	}
+
+	fi, err := os.Stat(file)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if fi.Mode().Perm() != 0600 {
+		t.Errorf("mode = %o, want 0600", fi.Mode().Perm())
+	}
+
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(entries) != 1 {
+		t.Errorf("expected only the target file, found %d entries", len(entries))
+	}
+}