refactor(config): publish config singletons through atomic pointers

The three configuration singletons (C_globalConfig, C_botUserConfig,
C_botNodeConfig) were plain variables: LoadGlobalConfig and friends assigned
them from the goroutine handling a settings update, while bot pipes, the node
tracker and the HTTP handlers read them from their own goroutines. That is an
unsynchronized read of a concurrently written variable — a data race the race
detector reports, and one that already existed before any hot-reload work
because /api/webhook/add reloads the configuration while the bots run.

Replace them with atomic.Pointer values behind Current(), BotUsers() and
BotNodes(). Each reload builds a fresh value and publishes it atomically, so a
reader either sees the previous configuration or the new one, never a partial
one. Callers read through the accessor on every use instead of caching it.

Two spots that read several fields of one guard now snapshot once per call, so
a reload cannot split a combined check mid-flight:
- qq_napcat.handleNapcatEvent, which evaluates the debug guards per event
- the komari task-echo guard, now behind taskEchoEnabled()

The NapCat HTTP methods keep logging on showNapcatAction alone (without
requiring debugMode), matching their existing behaviour; that inconsistency
with the WebSocket path is preserved, not introduced, and is called out in
actionLogEnabled.

Also adds TestConcurrentReloadAndRead, which drives every accessor from four
reader goroutines while two writers reload the configuration, and sanitises the
member IDs used as test fixtures in config/settings_test.go.

Co-Authored-By: Claude Code <noreply@anthropic.com>

internal/komari/client.go

@@ -18,6 +18,14 @@ import (
 	"nukumizu-backend/postLog"
 )
 
+// taskEchoEnabled reports whether Komari task progress should be echoed to the
+// log: debug mode plus the showKomariTaskEcho toggle. The configuration is read
+// once per call so both flags come from the same reload.
+func taskEchoEnabled() bool {
+	cfg := config.Current()
+	return cfg != nil && cfg.System.DebugMode && cfg.Debug.ShowKomariTaskEcho
+}
+
 // NodeInfo represents a single node as returned by Komari's
 // common:getNodes RPC2 method.
 type NodeInfo struct {
@@ -146,7 +154,7 @@ func (c *Client) Login(username, password string) error {
 
 	var kr KomariResponse
 	if err := json.NewDecoder(resp.Body).Decode(&kr); err != nil {
-		if config.C_globalConfig.System.DebugMode {
+		if config.IsDebugMode() {
 			respBody, _ := io.ReadAll(resp.Body)
 			return fmt.Errorf("failed to parse komari login response: %w.\nResponse: %s", err, respBody)
 		}
@@ -332,7 +340,7 @@ func (c *Client) ExecTask(uuids []string, command string) (string, error) {
 		return "", fmt.Errorf("failed to parse komari task exec data: %w", err)
 	}
 
-	if config.C_globalConfig.System.DebugMode && config.C_globalConfig.Debug.ShowKomariTaskEcho {
+	if taskEchoEnabled() {
 		postLog.Debug(fmt.Sprintf("Created Komari task %s for %d clients", result.TaskID, len(uuids)))
 	}
 	return result.TaskID, nil
@@ -375,7 +383,7 @@ func (c *Client) GetTaskResult(taskID string) ([]TaskResult, bool, error) {
 // PollTaskResult polls for task results every 1 second until all results are
 // available or 60 seconds have elapsed.
 func (c *Client) PollTaskResult(taskID string) ([]TaskResult, error) {
-	if config.C_globalConfig.System.DebugMode && config.C_globalConfig.Debug.ShowKomariTaskEcho {
+	if taskEchoEnabled() {
 		postLog.Debug(fmt.Sprintf("Polling for Komari task %s results...", taskID))
 	}
 
@@ -393,7 +401,7 @@ func (c *Client) PollTaskResult(taskID string) ([]TaskResult, error) {
 				return nil, err
 			}
 			if done {
-				if config.C_globalConfig.System.DebugMode && config.C_globalConfig.Debug.ShowKomariTaskEcho {
+				if taskEchoEnabled() {
 					postLog.Info(fmt.Sprintf("Task %s completed with %d results", taskID, len(results)))
 				}
 				return results, nil