feat(backend): unified response helpers, refresh token, security hardening

- new resp package (OK/Page/Fail/BadRequest/.../InternalErr): unified error
  envelope {detail, code?}, sanitized 500s (full error logged server-side,
  generic message to client - stops DB error leakage), pagination envelope
  {items,total,page,page_size}; migrate 200+ inline c.JSON error sites
- refresh token: 7d rotation tokens (SHA-256 hashed at rest), public
  POST /auth/refresh with single-use rotation, POST /auth/logout revokes
  all user refresh tokens (endpoint previously missing - frontend 404)
- security: gh-ost command line password masked in task status payload;
  Instance.MarshalJSON guarantees encrypted passwords never leave the API
  (removes reliance on per-handler manual masking); production (DEBUG=false)
  with default JWT secret now auto-generates and persists a random secret
- safe.Go recover wrapper for background goroutines (instance probe,
  gh-ost async)
- delete dead service layer (zero callers)
- fix pre-existing go vet unkeyed bson.E literals

backend/internal/handler/preferences.go

@@ -3,6 +3,7 @@ package handler
 import (
 	"encoding/json"
 	"net/http"
+	"sql-platform/internal/handler/resp"
 	"sql-platform/internal/middleware"
 	"sql-platform/internal/model"
 
@@ -14,7 +15,7 @@ func GetUserPreferences(c *gin.Context) {
 	userID, _, _ := middleware.GetCurrentUser(c)
 	var user model.User
 	if err := model.DB.First(&user, userID).Error; err != nil {
-		c.JSON(http.StatusNotFound, gin.H{"detail": "User not found"})
+		resp.NotFound(c, "User not found")
 		return
 	}
 
@@ -31,7 +32,7 @@ func UpdateUserPreferences(c *gin.Context) {
 
 	var prefs map[string]string
 	if err := c.ShouldBindJSON(&prefs); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		resp.BadRequest(c, err.Error())
 		return
 	}
 
@@ -40,7 +41,7 @@ func UpdateUserPreferences(c *gin.Context) {
 
 	result := model.DB.Model(&model.User{}).Where("id = ?", userID).Update("preferences", str)
 	if result.Error != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"detail": result.Error.Error()})
+		resp.InternalErr(c, result.Error)
 		return
 	}