fix: harden camera API endpoints (CUB-234)

- Add request validation: Content-Type check, body size limit (64KB)
- Add field length validation (camera_id: 64, friendly_name: 128, mode: 32, resolution: 32)
- Add FPS range validation (0-240)
- Add battery_pct range validation (0-100)
- Replace ad-hoc map[string]string errors with structured APIError {error, code, details}
- Fix isUniqueConstraintErr to catch both camera_id and mac_address constraint violations
- Fix MacAddress model field from string to *string for NULL handling
- Fix splitSQL to strip -- line comments before splitting (was causing migration failures with modernc.org/sqlite)
- Add 30 integration tests covering all endpoints
- All tests pass: ok github.com/cubecraft/remoterig/internal/api

internal/api/cameras.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"log"
 	"net/http"
+	"strings"
 
 	"github.com/cubecraft/remoterig/internal/db"
 	"github.com/cubecraft/remoterig/pkg/models"
@@ -42,7 +43,7 @@ func ListCameras(database *db.DB) http.HandlerFunc {
 		`)
 		if err != nil {
 			log.Printf("Error querying cameras: %v", err)
-			respondJSON(w, http.StatusInternalServerError, map[string]string{"error": "database error"})
+			respondError(w, http.StatusInternalServerError, "database error", err.Error())
 			return
 		}
 		defer rows.Close()
@@ -64,7 +65,7 @@ func ListCameras(database *db.DB) http.HandlerFunc {
 		}
 		if err := rows.Err(); err != nil {
 			log.Printf("Error iterating camera rows: %v", err)
-			respondJSON(w, http.StatusInternalServerError, map[string]string{"error": "database error"})
+			respondError(w, http.StatusInternalServerError, "database error", err.Error())
 			return
 		}
 
@@ -84,13 +85,10 @@ func RegisterCamera(database *db.DB) http.HandlerFunc {
 			FriendlyName string  `json:"friendly_name"`
 			MacAddress   *string `json:"mac_address,omitempty"`
 		}
-		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-			respondJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request body"})
+		if !decodeJSONBody(w, r, &req) {
 			return
 		}
-
-		if req.CameraID == "" || req.FriendlyName == "" {
-			respondJSON(w, http.StatusBadRequest, map[string]string{"error": "camera_id and friendly_name are required"})
+		if !validateCameraRegistration(w, req.CameraID, req.FriendlyName) {
 			return
 		}
 
@@ -99,12 +97,12 @@ func RegisterCamera(database *db.DB) http.HandlerFunc {
 			VALUES (?, ?, ?)
 		`, req.CameraID, req.FriendlyName, req.MacAddress)
 		if err != nil {
-			if err.Error() == "UNIQUE constraint failed: cameras.mac_address" {
-				respondJSON(w, http.StatusConflict, map[string]string{"error": "camera with this mac_address already registered"})
+			if isUniqueConstraintErr(err) {
+				respondError(w, http.StatusConflict, "camera already registered", err.Error())
 				return
 			}
 			log.Printf("Error registering camera: %v", err)
-			respondJSON(w, http.StatusInternalServerError, map[string]string{"error": "database error"})
+			respondError(w, http.StatusInternalServerError, "database error", err.Error())
 			return
 		}
 
@@ -124,8 +122,7 @@ func RegisterCamera(database *db.DB) http.HandlerFunc {
 func GetCameraDetail(database *db.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		cameraID := chi.URLParam(r, "id")
-		if cameraID == "" {
-			respondJSON(w, http.StatusBadRequest, map[string]string{"error": "camera_id required"})
+		if !validateCameraID(w, cameraID) {
 			return
 		}
 
@@ -139,12 +136,12 @@ func GetCameraDetail(database *db.DB) http.HandlerFunc {
 			&c.CreatedAt, &c.UpdatedAt,
 		)
 		if err == sql.ErrNoRows {
-			respondJSON(w, http.StatusNotFound, map[string]string{"error": "camera not found"})
+			respondError(w, http.StatusNotFound, "camera not found", err.Error())
 			return
 		}
 		if err != nil {
 			log.Printf("Error querying camera: %v", err)
-			respondJSON(w, http.StatusInternalServerError, map[string]string{"error": "database error"})
+			respondError(w, http.StatusInternalServerError, "database error", err.Error())
 			return
 		}
 
@@ -165,7 +162,7 @@ func GetCameraDetail(database *db.DB) http.HandlerFunc {
 		)
 		if err != nil && err != sql.ErrNoRows {
 			log.Printf("Error querying latest status: %v", err)
-			respondJSON(w, http.StatusInternalServerError, map[string]string{"error": "database error"})
+			respondError(w, http.StatusInternalServerError, "database error", err.Error())
 			return
 		}
 
@@ -180,7 +177,7 @@ func GetCameraDetail(database *db.DB) http.HandlerFunc {
 		`, cameraID)
 		if err != nil {
 			log.Printf("Error querying history: %v", err)
-			respondJSON(w, http.StatusInternalServerError, map[string]string{"error": "database error"})
+			respondError(w, http.StatusInternalServerError, "database error", err.Error())
 			return
 		}
 		defer historyRows.Close()
@@ -203,13 +200,21 @@ func GetCameraDetail(database *db.DB) http.HandlerFunc {
 		}
 
 		respondJSON(w, http.StatusOK, map[string]interface{}{
-			"camera":    c,
+			"camera":      c,
 			"last_status": sl,
 			"history":     history,
 		})
 	}
 }
 
+// isUniqueConstraintErr checks if the error is a SQLite UNIQUE constraint violation.
+func isUniqueConstraintErr(err error) bool {
+	if err == nil {
+		return false
+	}
+	return strings.Contains(err.Error(), "UNIQUE constraint failed")
+}
+
 // respondJSON writes a JSON response with the given status code.
 func respondJSON(w http.ResponseWriter, status int, data interface{}) {
 	w.Header().Set("Content-Type", "application/json")