fix: harden camera API endpoints (CUB-234)

- Add request validation: Content-Type check, body size limit (64KB)
- Add field length validation (camera_id: 64, friendly_name: 128, mode: 32, resolution: 32)
- Add FPS range validation (0-240)
- Add battery_pct range validation (0-100)
- Replace ad-hoc map[string]string errors with structured APIError {error, code, details}
- Fix isUniqueConstraintErr to catch both camera_id and mac_address constraint violations
- Fix MacAddress model field from string to *string for NULL handling
- Fix splitSQL to strip -- line comments before splitting (was causing migration failures with modernc.org/sqlite)
- Add 30 integration tests covering all endpoints
- All tests pass: ok github.com/cubecraft/remoterig/internal/api

internal/api/status.go

@@ -2,7 +2,6 @@
 package api
 
 import (
-	"encoding/json"
 	"log"
 	"net/http"
 
@@ -14,24 +13,31 @@ import (
 func PushStatus(database *db.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		cameraID := chi.URLParam(r, "id")
-		if cameraID == "" {
-			respondJSON(w, http.StatusBadRequest, map[string]string{"error": "camera_id required"})
+		if !validateCameraID(w, cameraID) {
 			return
 		}
 
 		var req struct {
-			BatteryPct        *int      `json:"battery_pct"`
-			VideoRemainingSec *int      `json:"video_remaining_sec"`
-			Recording         bool      `json:"recording"`
-			Mode              string    `json:"mode"`
-			Resolution        string    `json:"resolution"`
-			FPS               int       `json:"fps"`
-			Online            bool      `json:"online"`
-			RawBatteryPct    *float64  `json:"raw_battery_pct"`
-			Timestamp         *string   `json:"ts"`
+			BatteryPct        *int     `json:"battery_pct"`
+			VideoRemainingSec *int     `json:"video_remaining_sec"`
+			Recording         bool     `json:"recording"`
+			Mode              string   `json:"mode"`
+			Resolution        string   `json:"resolution"`
+			FPS               int      `json:"fps"`
+			Online            bool     `json:"online"`
+			RawBatteryPct     *float64 `json:"raw_battery_pct"`
+			Timestamp         *string  `json:"ts"`
 		}
-		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-			respondJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request body"})
+		if !decodeJSONBody(w, r, &req) {
+			return
+		}
+		if !validateStatusFields(w, req.Mode, req.Resolution, req.FPS) {
+			return
+		}
+
+		// Validate battery percentage range if provided
+		if req.BatteryPct != nil && (*req.BatteryPct < 0 || *req.BatteryPct > 100) {
+			respondError(w, http.StatusBadRequest, "battery_pct must be between 0 and 100")
 			return
 		}
 
@@ -39,8 +45,13 @@ func PushStatus(database *db.DB) http.HandlerFunc {
 		var exists int
 		err := database.QueryRowContext(r.Context(),
 			"SELECT COUNT(*) FROM cameras WHERE camera_id = ?", cameraID).Scan(&exists)
-		if err != nil || exists == 0 {
-			respondJSON(w, http.StatusNotFound, map[string]string{"error": "camera not registered"})
+		if err != nil {
+			log.Printf("Error checking camera existence: %v", err)
+			respondError(w, http.StatusInternalServerError, "database error", err.Error())
+			return
+		}
+		if exists == 0 {
+			respondError(w, http.StatusNotFound, "camera not found")
 			return
 		}
 
@@ -54,7 +65,7 @@ func PushStatus(database *db.DB) http.HandlerFunc {
 			req.FPS, boolToInt(req.Online), req.RawBatteryPct)
 		if err != nil {
 			log.Printf("Error inserting status log: %v", err)
-			respondJSON(w, http.StatusInternalServerError, map[string]string{"error": "database error"})
+			respondError(w, http.StatusInternalServerError, "database error", err.Error())
 			return
 		}