fix: eliminate Go security findings and harden file handling

[keller0]

Summary

• upgrade Go version directive to 1.25.12 to pull in patched standard-library security fixes
• upgrade direct dependencies to latest stable (cobra)
• remove gin stack and refactor HTTP server to standard library net/http
• remove the transitive gin -> validator -> golang.org/x/crypto dependency chain that kept surfacing module-level security warnings
• add server-side file name sanitization to prevent path traversal style inputs on upload/delete
• add mutex protection for shared in-memory state accessed by concurrent requests
• add unit and HTTP handler tests for core share flows

Why

Repository security checks initially showed reachable vulnerabilities and additional module warnings. After dependency upgrades there was still an unfixed module-level advisory tied to golang.org/x/crypto/openpgp in transitive dependencies. Replacing gin with standard library handlers removes that dependency chain entirely and reduces attack surface. Tests lock in the new HTTP behavior and security hardening.

Changes

• http.go
  • replaced gin routes with net/http handlers for /, /submit, /clearAll, /deleteFile, /upload, static routes
  • added sanitizeFileName validation for upload/delete file names
  • added JSON helper and template render helper
  • added sync.RWMutex to guard shared state (sData, imgList, fileList)
  • serve uploaded files from http.Dir(tmpFileDir) so absolute and relative folders both work
• http_test.go
  • unit tests for sanitizeFileName and isImgSimple
  • HTTP tests for index, submit, upload, serve, delete, clearAll, method checks, and old-file loading
• go.mod
  • removed gin and all related transitive web stack modules
  • retained only cobra direct dependency
• go.sum
  • regenerated to match reduced dependency graph

Validation

• go test -v -race -buildvcs ./...
• go test -cover ./... (about 70.7% statement coverage)
• govulncheck ./...
• govulncheck -show verbose ./...

All validation commands pass and govulncheck reports No vulnerabilities found.