Phase 2b: server/client timeouts, atomic state writes, log mutex, panic and shutdown fixes

- http.Server with ReadHeaderTimeout/IdleTimeout (no read/write timeouts: /stream/ is long-lived)
- shared outbound clients: providerHTTPClient (5m), apiHTTPClient (30s), imgcache client (30s)
- imgcache: download outside the lock, per-item helper, cache URL uses the file name not the fs path
- writeFileAtomic (temp + fsync + rename) for settings/xepg/pms/urls/authentication JSON
- one package-level logMu for WebScreenLog and notifications; ring buffer keeps the newest lines
- notifications evict the oldest instead of random map entries
- xepg XMLTV file removal rebuilt after the loop; data.go range-mutation removed
- API handler returns after error body; WS request/response fresh per command
- checked type assertions in data/backup/provider/screen
- SIGINT/SIGTERM handled in main via src.Shutdown(); fatal paths exit 1

src/internal/authentication/authentication.go

@@ -411,11 +411,47 @@ func saveDatabase(tmpMap any) (err error) {
 		return
 	}
 
-	err = os.WriteFile(database, []byte(jsonString), 0600)
+	err = writeFileAtomic(database, []byte(jsonString), 0600)
+
+	return
+}
+
+// writeFileAtomic : Temp file + fsync + rename, so authentication.json is
+// never observed half-written. (Private copy; this package cannot import src.)
+func writeFileAtomic(name string, data []byte, perm os.FileMode) (err error) {
+
+	tmp, err := os.CreateTemp(filepath.Dir(name), ".tmp-*")
 	if err != nil {
 		return
 	}
 
+	var tmpName = tmp.Name()
+
+	defer func() {
+		if err != nil {
+			tmp.Close()
+			os.Remove(tmpName)
+		}
+	}()
+
+	if _, err = tmp.Write(data); err != nil {
+		return
+	}
+
+	if err = tmp.Sync(); err != nil {
+		return
+	}
+
+	if err = tmp.Close(); err != nil {
+		return
+	}
+
+	if err = os.Chmod(tmpName, perm); err != nil {
+		return
+	}
+
+	err = os.Rename(tmpName, name)
+
 	return
 }