fix: chat build syntax errors, disable GitHub cache on Gitea runner

- Fix 3 orphaned function bodies in main.go (handleAdminSchedule,
  handleAdminSystemSummary, probeMediaDurationSeconds) caused by
  insertions that split function headers from bodies
- Remove cache: true from setup-go and cache: npm from setup-node
  (Gitea runner times out 135s trying to reach GitHub cache API)
- Add go vet ./... step replacing placeholder echo
- Remove || echo fallback from lint (tsc --noEmit is working)

.github/instructions/BACKLOG.md

@@ -0,0 +1,121 @@
+# BACKLOG
+
+## Playout & Delivery
+
+- [x] Implement FFmpeg + MediaMTX/SRS continuous HLS playout from playlist
+- [x] Implement immutable HLS segment naming for cache-friendly delivery
+- [x] Upload HLS segments to Cloudflare R2 via S3-compatible API
+- [x] Implement emergency slate fallback on playout failure
+- [x] Auto-restart loop for FFmpeg/MediaMTX on failure
+
+## Video Normalization
+
+- [x] Implement video normalization pipeline (H.264/AAC, 30 fps, 2 s keyframes)
+- [x] Implement ffprobe verification gate rejecting non-conforming files
+- [x] Enforce normalization check before upload acceptance in admin UI
+
+## Chat Service
+
+- [x] Implement WebSocket chat backend (Go) with room fan-out
+- [x] Implement private DM channel routing
+- [x] Implement Redis presence tracking for chat
+- [ ] Implement Redis pub/sub for multi-instance chat
+- [x] Implement Redis rate limiting (INCR + EXPIRE windowing, >10/10s throttle)
+- [x] Implement chat message persistence (SQLite v1, PostgreSQL migration path)
+- [x] Implement moderation commands (/mod, /mute, /ban) in backend
+- [x] Implement moderation audit log persistence
+- [x] Implement graceful degradation when Redis unavailable (core chat remains up)
+
+## Frontend — Viewer SPA
+
+- [x] Build static SPA with hls.js player integration
+- [x] Build chat sidebar UI (public rooms + private DMs)
+- [x] Implement schedule metadata display synced with playlist timeline
+- [x] Implement responsive/mobile-friendly viewer layout
+
+## Frontend — Admin Interfaces
+
+- [x] Build admin login page with session authentication
+- [x] Build admin dashboard overview page
+- [x] Build video upload interface with chunked upload support
+- [x] Build playlist management interface (drag-to-reorder, validation warnings)
+- [x] Build schedule override/management interface (CRUD + conflict detection)
+- [x] Build user management interface (mute/unmute/ban/unban actions)
+- [x] Build moderation dashboard (chat log, inline mod actions, CSV export)
+- [x] Build analytics dashboard (time range selector)
+- [x] Build system configuration/status page (config editor, restart buttons)
+
+## Infrastructure — nginx
+
+- [x] Configure nginx reverse proxy with auth_request for admin paths
+- [x] Configure nginx HLS path with CORS headers + OPTIONS preflight
+- [x] Configure nginx WebSocket upgrade forwarding for /ws
+- [x] Configure nginx health endpoints (/health JSON, stub_status)
+
+## Infrastructure — Docker
+
+- [x] Create Dockerfiles for playout, chat, nginx services
+- [x] Create docker-compose.yml for all services
+- [x] Create docker-compose.prod.yml override for production
+
+## Infrastructure — CI/CD (Gitea Actions)
+
+- [x] Implement CI workflow (lint, build, test, push images)
+- [x] Implement CD workflow (pull, deploy, health checks — IP-agnostic)
+- [x] Generate .env from Gitea secrets in CD workflow
+- [x] Seed Prometheus config into named volume during deploy
+- [x] Implement health check validation with retry in CD pipeline
+
+## Cloudflare Configuration
+
+- [ ] Configure DNS for linearvoid.tv apex and www redirect (manual)
+- [ ] Configure media.linearvoid.tv for split-domain HLS delivery (manual)
+- [ ] Create R2 bucket (manual)
+- [ ] Configure Cache Rules: .ts/.m4s + .m3u8 (manual)
+- [ ] Configure Cloudflare Pages (manual)
+- [ ] Enable Tiered Cache, WAF, rate limiting (manual)
+- [x] Implement Worker for immutable cache headers on segment paths
+- [ ] Enforce HTTPS/WSS, redirect HTTP → HTTPS (manual)
+
+## Monitoring & Observability
+
+- [x] Set up Prometheus with chat scrape target
+- [ ] Add nginx/redis/postgres/node exporters
+- [x] Import Grafana app + operational dashboards
+- [ ] Define Prometheus alerting rules
+- [ ] Set up UptimeRobot external monitoring
+
+## Security
+
+- [x] Implement admin cookie-session auth (HttpOnly, SameSite=Strict, Secure when TLS)
+- [x] Implement server-side session expiration
+- [ ] Enforce HTTPS/WSS at edge and origin
+- [x] Implement rate limiting for chat messages with Redis windowing
+
+## Data & Storage
+
+- [x] Set up PostgreSQL/SQLite for chat history and moderation data
+- [x] Set up Redis with append-only persistence + maxmemory policy
+- [ ] Implement daily/weekly/monthly Postgres backups
+- [ ] Implement backup integrity verification
+- [ ] Document and rehearse recovery runbook
+
+## Scaling & Performance
+
+- [ ] Optimize segment immutability and manifest TTL for cache efficiency
+- [ ] Measure playback TTFB from multiple US regions
+- [ ] Load-test WebSocket connections
+- [ ] Benchmark admin API p95 latency
+- [ ] Track cache hit ratio and R2 ops in production
+- [ ] Capacity trigger monitoring
+- [ ] Plan Phase 2 service separation
+- [ ] Plan Phase 3 multi-origin resilience
+
+## Documentation
+
+- [x] Document API contracts in API.md
+- [ ] Document deployment runbook in DEPLOYMENT.md
+- [ ] Document monitoring setup in MONITORING.md
+- [ ] Document security model in SECURITY.md
+- [ ] Create incident runbook
+- [ ] Write Level 2/3 building block views