refactor(config): publish config singletons through atomic pointers

The three configuration singletons (C_globalConfig, C_botUserConfig,
C_botNodeConfig) were plain variables: LoadGlobalConfig and friends assigned
them from the goroutine handling a settings update, while bot pipes, the node
tracker and the HTTP handlers read them from their own goroutines. That is an
unsynchronized read of a concurrently written variable — a data race the race
detector reports, and one that already existed before any hot-reload work
because /api/webhook/add reloads the configuration while the bots run.

Replace them with atomic.Pointer values behind Current(), BotUsers() and
BotNodes(). Each reload builds a fresh value and publishes it atomically, so a
reader either sees the previous configuration or the new one, never a partial
one. Callers read through the accessor on every use instead of caching it.

Two spots that read several fields of one guard now snapshot once per call, so
a reload cannot split a combined check mid-flight:
- qq_napcat.handleNapcatEvent, which evaluates the debug guards per event
- the komari task-echo guard, now behind taskEchoEnabled()

The NapCat HTTP methods keep logging on showNapcatAction alone (without
requiring debugMode), matching their existing behaviour; that inconsistency
with the WebSocket path is preserved, not introduced, and is called out in
actionLogEnabled.

Also adds TestConcurrentReloadAndRead, which drives every accessor from four
reader goroutines while two writers reload the configuration, and sanitises the
member IDs used as test fixtures in config/settings_test.go.

Co-Authored-By: Claude Code <noreply@anthropic.com>

internal/controller/pipes/qq_napcat/napcat.go

@@ -17,6 +17,15 @@ import (
 	"nukumizu-backend/postLog"
 )
 
+// actionLogEnabled reports whether the NapCat HTTP API methods echo each action
+// they send, per the showNapcatAction toggle. Unlike the WebSocket message path
+// in qq.go it deliberately does not also require debugMode: these methods have
+// always logged on this toggle alone, and preserving that is intentional.
+func actionLogEnabled() bool {
+	cfg := config.Current()
+	return cfg != nil && cfg.Debug.ShowNapcatAction
+}
+
 // APIResponse mirrors NapCat's HTTP API response envelope.
 type APIResponse struct {
 	Status  string          `json:"status"`
@@ -155,7 +164,7 @@ func (c *Client) SendMsg(targetType string, targetID int64, msg string, hasAt bo
 		return nil, fmt.Errorf("failed to marshal request: %w", err)
 	}
 
-	if config.C_globalConfig.Debug.ShowNapcatAction {
+	if actionLogEnabled() {
 		postLog.Debug(fmt.Sprintf("[Napcat] SendMsg -> %s (%s): %s", endpoint, targetType, message))
 	}
 
@@ -176,7 +185,7 @@ func (c *Client) RecallMsg(msgID int64) (*APIResponse, error) {
 		return nil, fmt.Errorf("failed to marshal request: %w", err)
 	}
 
-	if config.C_globalConfig.Debug.ShowNapcatAction {
+	if actionLogEnabled() {
 		postLog.Debug(fmt.Sprintf("[Napcat] RecallMsg -> /delete_msg: %d", msgID))
 	}
 
@@ -190,7 +199,7 @@ func (c *Client) RecallMsg(msgID int64) (*APIResponse, error) {
 
 // GetGroupList retrieves the list of joined groups from NapCat.
 func (c *Client) GetGroupList() (*APIResponse, error) {
-	if config.C_globalConfig.Debug.ShowNapcatAction {
+	if actionLogEnabled() {
 		postLog.Debug("[Napcat] GetGroupList -> /get_group_list")
 	}
 
@@ -211,7 +220,7 @@ func (c *Client) GetGroupInfo(groupID int64) (*APIResponse, error) {
 		return nil, fmt.Errorf("failed to marshal request: %w", err)
 	}
 
-	if config.C_globalConfig.Debug.ShowNapcatAction {
+	if actionLogEnabled() {
 		postLog.Debug(fmt.Sprintf("[Napcat] GetGroupInfo -> /get_group_info: %d", groupID))
 	}
 
@@ -225,7 +234,7 @@ func (c *Client) GetGroupInfo(groupID int64) (*APIResponse, error) {
 
 // GetFriendsList retrieves the friends list from NapCat.
 func (c *Client) GetFriendsList() (*APIResponse, error) {
-	if config.C_globalConfig.Debug.ShowNapcatAction {
+	if actionLogEnabled() {
 		postLog.Debug("[Napcat] GetFriendsList -> /get_friend_list")
 	}