fix: harden camera API endpoints (CUB-234)

- Add request validation: Content-Type check, body size limit (64KB)
- Add field length validation (camera_id: 64, friendly_name: 128, mode: 32, resolution: 32)
- Add FPS range validation (0-240)
- Add battery_pct range validation (0-100)
- Replace ad-hoc map[string]string errors with structured APIError {error, code, details}
- Fix isUniqueConstraintErr to catch both camera_id and mac_address constraint violations
- Fix MacAddress model field from string to *string for NULL handling
- Fix splitSQL to strip -- line comments before splitting (was causing migration failures with modernc.org/sqlite)
- Add 30 integration tests covering all endpoints
- All tests pass: ok github.com/cubecraft/remoterig/internal/api

internal/api/recording.go

@@ -13,8 +13,7 @@ import (
 func StartRecording(database *db.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		cameraID := chi.URLParam(r, "id")
-		if cameraID == "" {
-			respondJSON(w, http.StatusBadRequest, map[string]string{"error": "camera_id required"})
+		if !validateCameraID(w, cameraID) {
 			return
 		}
 
@@ -22,8 +21,13 @@ func StartRecording(database *db.DB) http.HandlerFunc {
 		var exists int
 		err := database.QueryRowContext(r.Context(),
 			"SELECT COUNT(*) FROM cameras WHERE camera_id = ?", cameraID).Scan(&exists)
-		if err != nil || exists == 0 {
-			respondJSON(w, http.StatusNotFound, map[string]string{"error": "camera not registered"})
+		if err != nil {
+			log.Printf("Error checking camera existence: %v", err)
+			respondError(w, http.StatusInternalServerError, "database error", err.Error())
+			return
+		}
+		if exists == 0 {
+			respondError(w, http.StatusNotFound, "camera not found")
 			return
 		}
 
@@ -34,12 +38,12 @@ func StartRecording(database *db.DB) http.HandlerFunc {
 		`, cameraID)
 		if err != nil {
 			log.Printf("Error starting recording: %v", err)
-			respondJSON(w, http.StatusInternalServerError, map[string]string{"error": "database error"})
+			respondError(w, http.StatusInternalServerError, "database error", err.Error())
 			return
 		}
 
-		rows, _ := result.RowsAffected()
-		log.Printf("Recording started on %s (%d rows affected)", cameraID, rows)
+		rowsAffected, _ := result.RowsAffected()
+		log.Printf("Recording started on %s (%d rows affected)", cameraID, rowsAffected)
 
 		respondJSON(w, http.StatusOK, map[string]string{
 			"status":    "recording_started",
@@ -52,8 +56,7 @@ func StartRecording(database *db.DB) http.HandlerFunc {
 func StopRecording(database *db.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		cameraID := chi.URLParam(r, "id")
-		if cameraID == "" {
-			respondJSON(w, http.StatusBadRequest, map[string]string{"error": "camera_id required"})
+		if !validateCameraID(w, cameraID) {
 			return
 		}
 
@@ -61,8 +64,13 @@ func StopRecording(database *db.DB) http.HandlerFunc {
 		var exists int
 		err := database.QueryRowContext(r.Context(),
 			"SELECT COUNT(*) FROM cameras WHERE camera_id = ?", cameraID).Scan(&exists)
-		if err != nil || exists == 0 {
-			respondJSON(w, http.StatusNotFound, map[string]string{"error": "camera not registered"})
+		if err != nil {
+			log.Printf("Error checking camera existence: %v", err)
+			respondError(w, http.StatusInternalServerError, "database error", err.Error())
+			return
+		}
+		if exists == 0 {
+			respondError(w, http.StatusNotFound, "camera not found")
 			return
 		}
 
@@ -73,12 +81,12 @@ func StopRecording(database *db.DB) http.HandlerFunc {
 		`, cameraID)
 		if err != nil {
 			log.Printf("Error stopping recording: %v", err)
-			respondJSON(w, http.StatusInternalServerError, map[string]string{"error": "database error"})
+			respondError(w, http.StatusInternalServerError, "database error", err.Error())
 			return
 		}
 
-		rows, _ := result.RowsAffected()
-		log.Printf("Recording stopped on %s (%d rows affected)", cameraID, rows)
+		rowsAffected, _ := result.RowsAffected()
+		log.Printf("Recording stopped on %s (%d rows affected)", cameraID, rowsAffected)
 
 		respondJSON(w, http.StatusOK, map[string]string{
 			"status":    "recording_stopped",