feat(server): Go 模块骨架 + 工具链 [tsk_L2k2VrEujof8]

新建 server/ Go 模块：
- go.mod: module github.com/wangjia/pangolin/server, Go 1.22
  依赖: go-chi/chi/v5, google/uuid
- tools.go: //go:build tools 锁定 oapi-codegen / golang-migrate 版本
- cmd/server/main.go: chi router + GET /healthz → {"status":"ok"}，监听 :8080
- cmd/migrate/main.go: 占位入口（实逻辑归 1e）
- internal/{config,store,apierr,idgen,auth,codes,devices,nodes,usage,admin}/doc.go
  各包职责说明
- Makefile: build/test/vet/lint/generate/migrate-up/migrate-down
- .golangci.yml: govet/errcheck/staticcheck/revive/gofmt 基线
- README.md: 定位 + 目录树 + make 入口说明
- setup.sh: 首次 go mod tidy 引导脚本（go.sum 需运行后生成）

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/internal/admin/doc.go

@@ -0,0 +1,5 @@
+// Package admin exposes internal management endpoints: code-batch generation,
+// node CRUD, user lookup/ban, and audit-log queries. The admin router is
+// mounted on a separate listener (or sub-path) protected by IP allowlist
+// and two-factor authentication — it is never exposed on the public API port.
+package admin

server/internal/apierr/doc.go

@@ -0,0 +1,5 @@
+// Package apierr defines the canonical error response shape used across all
+// v1 API handlers: {code, message_zh, message_en}. It provides constructor
+// helpers for common HTTP error categories (400/401/403/404/409/429/500)
+// and a middleware that serialises *APIError values to JSON automatically.
+package apierr

server/internal/auth/doc.go

@@ -0,0 +1,5 @@
+// Package auth handles all authentication concerns: email verification codes
+// (Redis-backed, rate-limited), password hashing (argon2id), JWT issuance
+// (RS256, access 15 min + refresh 30 d), and the HTTP middleware that
+// validates bearer tokens and injects claims into request context.
+package auth

server/internal/codes/doc.go

@@ -0,0 +1,5 @@
+// Package codes manages activation code lifecycle: batch generation,
+// webhook ingestion from card-selling stores, idempotent redemption
+// (subscription extension), and fraud controls (per-user failure
+// rate-limiting). All redemptions are recorded in the audit log.
+package codes

server/internal/config/doc.go

@@ -0,0 +1,4 @@
+// Package config loads and validates server configuration from environment
+// variables and optional config files. It provides a single Config struct
+// consumed by all other packages at startup.
+package config

server/internal/devices/doc.go

@@ -0,0 +1,5 @@
+// Package devices manages user devices (name, platform, WireGuard public key).
+// It enforces per-plan device-count limits and coordinates with the nodes
+// package to revoke WireGuard peers when a device is removed or a
+// subscription expires.
+package devices

server/internal/idgen/doc.go

@@ -0,0 +1,5 @@
+// Package idgen generates application-level identifiers.
+// For most entities it wraps github.com/google/uuid (v7 time-ordered UUIDs).
+// For activation codes it produces 16-character Crockford Base32 strings
+// with a check digit, suitable for display and human entry.
+package idgen

server/internal/nodes/doc.go

@@ -0,0 +1,5 @@
+// Package nodes owns the node catalogue (region, tier, status, weight) and
+// the connect/disconnect flow. It communicates with node agents over mTLS
+// gRPC to add and remove WireGuard peers, and exposes a versioned catalogue
+// endpoint with 304 support so clients can cache node lists efficiently.
+package nodes

server/internal/store/doc.go

@@ -0,0 +1,6 @@
+// Package store provides the database access layer for Pangolin.
+// It wraps Postgres (via database/sql) and exposes typed repository
+// interfaces for each domain entity: users, devices, plans, subscriptions,
+// codes, nodes, usage, and audit log. Migrations are managed separately
+// by the migrate command.
+package store

server/internal/usage/doc.go

@@ -0,0 +1,5 @@
+// Package usage records per-user daily traffic and session minutes in
+// usage_daily. It enforces free-plan daily caps and tracks ad-unlock
+// timestamps. No destination addresses or DNS queries are stored —
+// only aggregate byte counts and minute counts, per the no-log policy.
+package usage