ci: bump Go to 1.25 and fix goimports drift in 3 files

golangci-lint v2.11.4 requires Go >= 1.25. With the workflow on 1.24,
setup-go would silently trigger an in-job auto-toolchain download
(observed in run #71: 'go: github.com/golangci/golangci-lint/v2@v2.11.4
requires go >= 1.25.0; switching to go1.25.9') adding ~3 min to every
Backend (Go) run.

Bump setup-go to 1.25 in ci.yml, backend-ci.yml, go-fuzz.yml so the
prebuilt Go is already the right version.

Also lint-fix three files that golangci-lint's goimports checker
flagged — goimports sorts/groups imports and removes unused ones,
which plain gofmt leaves alone:
  - veza-backend-api/cmd/api/main.go
  - veza-backend-api/internal/api/handlers/chat_handlers.go
  - veza-backend-api/internal/handlers/auth_integration_test.go

.github/workflows/backend-ci.yml

@@ -28,7 +28,7 @@ jobs:
             - name: Set up Go
               uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
               with:
-                  go-version: "1.24"
+                  go-version: "1.25"
                   cache: true
                   cache-dependency-path: veza-backend-api/go.sum
 
@@ -153,7 +153,7 @@ jobs:
             - name: Set up Go
               uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
               with:
-                  go-version: "1.24"
+                  go-version: "1.25"
                   cache: true
                   cache-dependency-path: veza-backend-api/go.sum
 

.github/workflows/ci.yml

@@ -25,7 +25,7 @@ jobs:
             - name: Set up Go
               uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
               with:
-                  go-version: "1.24"
+                  go-version: "1.25"
                   cache: true
                   # go.mod/go.sum live under veza-backend-api, not repo root.
                   # Without this, setup-go warns "Dependencies file is not

.github/workflows/go-fuzz.yml

@@ -24,7 +24,7 @@ jobs:
             - name: Set up Go
               uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
               with:
-                  go-version: "1.24"
+                  go-version: "1.25"
                   cache: true
 
             - name: Download deps

.gitignore

@@ -158,3 +158,41 @@ veza-backend-api/audio/
 # SELinux policy (local)
 qemu-fusefs.*
 api
+
+# ============================================================
+# Post-audit J1 (2026-04-14) — never recommit this debris
+# ============================================================
+# Go binaries accidentally committed (v1.0.3 → v1.0.4 cleanup)
+veza-backend-api/server
+veza-backend-api/modern-server
+veza-backend-api/seed
+veza-backend-api/seed-v2
+veza-backend-api/encrypt_oauth_tokens
+
+# Coverage reports (generated, never tracked)
+veza-backend-api/coverage*.out
+veza-backend-api/coverage_groups/
+
+# Frontend build/lint/test artifacts
+apps/web/lint_report*.json
+apps/web/tsc*.log
+apps/web/tsc*.txt
+apps/web/ts_*.log
+apps/web/storybook_*.json
+apps/web/debug-storybook.log
+apps/web/build_errors*.txt
+apps/web/build_output.txt
+apps/web/final_errors.txt
+apps/web/*.log
+apps/web/diagnostic-*.log
+apps/web/frontend.log
+apps/web/audit.log
+
+# Backend local logs
+veza-backend-api/backend*.log
+
+# Root audit screenshots (belong in docs/assets/ if needed)
+/audit-*.png
+
+# AI tooling session state (not code)
+.cursor/

veza-backend-api/cmd/api/main.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"log"
 	"net/http"
+
 	// SECURITY(REM-027): pprof removed from production — use build tag or dedicated debug binary instead.
 	// To enable: go build -tags debug ./cmd/api
 	"os"

veza-backend-api/internal/api/handlers/chat_handlers.go

@@ -10,7 +10,6 @@ import (
 	"strconv"
 
 	"github.com/gin-gonic/gin"
-	"github.com/google/uuid"
 	"go.uber.org/zap"
 
 	"veza-backend-api/internal/services"

veza-backend-api/internal/handlers/auth_integration_test.go

@@ -5,13 +5,11 @@ package handlers
 
 import (
 	"bytes"
-	"context"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 	"testing"
-	"time"
 
 	"veza-backend-api/internal/core/auth"
 	"veza-backend-api/internal/database"
@@ -26,7 +24,6 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.uber.org/zap"
 	"go.uber.org/zap/zaptest"
 	"gorm.io/driver/sqlite"
 	"gorm.io/gorm"