refactor: audit-driven hygiene pass across modules and infra

Concurrency
- lolschedule: serialize subscriber Get→mutate→Put via state.subscribersMu;
  the single-slot list was previously losing writes under concurrent
  /lolschedule_subscribe.
- trading: PriceClient memoises its default *http.Client so /trade_stats
  reuses TLS connections across held tickers.

Observability
- server/log_middleware: defer the req log line and recover panics so a
  panicking cron handler still emits the structured req entry CloudWatch
  filters on for 5xx alerting.
- server/router (cron): inner recover with cron-name context captures the
  panicking job before the middleware's safety net does.
- telegram/webhook: rune-safe truncation in dispatch logs — Vietnamese,
  Korean, and emoji previews no longer ship as garbled bytes.
- lolschedule/api_client: same rune-safe fix for error-body log truncation.
- telegram/webhook: gate the post-recover WriteHeader(200) so a panicking
  handler that already touched w doesn't trigger superfluous-WriteHeader.

Correctness
- twentyq: clearGame error during solved-relaunch is logged instead of
  silently swallowed (was a permanent deadlock vector on KV failure).
- misc /mstats: KV read failure replies "Could not load stats. Try again
  later." to the user instead of returning into the dispatcher; matches the
  pattern other modules use.
- migrate_cf_data trading-audit-dump: surface f.Close error so a truncated
  JSONL never passes silently as a complete audit dump.

Operator ergonomics
- migrate_cf_data (all 4 subcommands): signal.NotifyContext for SIGINT /
  SIGTERM. Ctrl-C mid-Scan now propagates cleanly instead of leaving a
  half-converted DynamoDB table.
- ai/ratelimit: doc the Lambda-recycle memory bound to match keylock.Map
  so a future reviewer doesn't re-flag the unbounded map.

I/O-changing (user-approved)
- lolschedule daily push auto-prunes subscribers whose Telegram error
  matches a terminal marker (blocked / deactivated / chat gone). Transient
  errors keep the chat on the list. Subscribe message updated to mention
  the auto-cleanup.
- twentyq seed pool grown 50 → 178; repeat-collision threshold moves from
  ~9 plays to ~17 (birthday paradox).
- util /info flipped Public → Protected — chat/thread/sender IDs are no
  longer enumerable by every group member.
- cmd/server WriteTimeout 6min → 75s (cron 60s + 15s slack). No-op on
  Lambda; matters only for local non-Lambda runs.
- webhook + cron rejection paths drop response bodies (no fingerprintable
  text for internet scanners hitting the public Function URL). Status
  codes preserved for CloudWatch metrics; structured log lines carry the
  rejection reason for operator triage.

Tests added: TestTruncateRunes, TestRunDailyPush_PrunesDeadSubscribers,
TestIsTerminalSendError, TestInfo_DeniedToNonOwner,
TestInfo_DeniedToChannelMessageNoFrom, plus owner-allowed counterparts.

cmd/migrate_cf_data/convert_value.go

@@ -17,6 +17,14 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/dynamodb/types"
 )
 
+// signalContext is defined in main.go and gives every subcommand a SIGINT /
+// SIGTERM-cancellable context — Ctrl-C mid-scan now propagates as a clean
+// context error instead of leaving a half-converted table.
+//
+// (signature mirrors signal.NotifyContext for documentation purposes; no
+// re-declaration here, just a pointer for future readers.)
+
+
 func runConvertValueToString(args []string) error {
 	fs := flag.NewFlagSet("convert-value-to-string", flag.ExitOnError)
 	table := fs.String("table", "", "target DynamoDB table (required)")
@@ -28,7 +36,8 @@ func runConvertValueToString(args []string) error {
 		return fmt.Errorf("--table is required")
 	}
 
-	ctx := context.Background()
+	ctx, cancel := signalContext()
+	defer cancel()
 	cfg, err := awsconfig.LoadDefaultConfig(ctx)
 	if err != nil {
 		return fmt.Errorf("aws config: %w", err)

cmd/migrate_cf_data/main.go

@@ -37,12 +37,21 @@ import (
 	"flag"
 	"fmt"
 	"os"
+	"os/signal"
+	"syscall"
 
 	awsconfig "github.com/aws/aws-sdk-go-v2/config"
 	"github.com/aws/aws-sdk-go-v2/service/dynamodb"
 	"github.com/tiennm99/miti99bot/internal/migration"
 )
 
+// signalContext returns a context cancelled on Ctrl-C / SIGTERM. Used by every
+// subcommand so a mid-scan abort leaves a clean error trail instead of a
+// half-converted table the operator has to reason about.
+func signalContext() (context.Context, context.CancelFunc) {
+	return signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+}
+
 func main() {
 	if len(os.Args) < 2 {
 		usage()
@@ -86,7 +95,8 @@ func runInventory(args []string) error {
 	if err != nil {
 		return err
 	}
-	ctx := context.Background()
+	ctx, cancel := signalContext()
+	defer cancel()
 	keys, err := kv.ListKeys(ctx)
 	if err != nil {
 		return fmt.Errorf("list keys: %w", err)
@@ -128,7 +138,8 @@ func runKVImport(args []string) error {
 	if err != nil {
 		return err
 	}
-	ctx := context.Background()
+	ctx, cancel := signalContext()
+	defer cancel()
 	var writer *migration.DynamoDBWriter
 	if !*dryRun {
 		cfg, err := awsconfig.LoadDefaultConfig(ctx)
@@ -186,7 +197,9 @@ func runTradingAuditDump(args []string) error {
 	if err != nil {
 		return err
 	}
-	rows, err := d1.Query(context.Background(),
+	ctx, cancel := signalContext()
+	defer cancel()
+	rows, err := d1.Query(ctx,
 		"SELECT id, user_id, symbol, side, qty, price_vnd, ts FROM trading_trades ORDER BY id", nil)
 	if err != nil {
 		return fmt.Errorf("d1 query: %w", err)
@@ -195,13 +208,20 @@ func runTradingAuditDump(args []string) error {
 	if err != nil {
 		return err
 	}
-	defer func() { _ = f.Close() }()
+	// Surface Close's error: an audit JSONL that fails to flush is silently
+	// truncated otherwise. Encode succeeding doesn't guarantee fsync — if
+	// the final Close hits ENOSPC the operator must see it (this file is
+	// evidence; a partial dump is worse than no dump).
 	enc := json.NewEncoder(f)
 	for _, r := range rows {
 		if err := enc.Encode(r); err != nil {
+			_ = f.Close()
 			return err
 		}
 	}
+	if err := f.Close(); err != nil {
+		return fmt.Errorf("close audit dump: %w", err)
+	}
 	fmt.Printf("Wrote %d rows to %s\n", len(rows), *out)
 	return nil
 }

cmd/server/main.go

@@ -136,9 +136,12 @@ func main() {
 		Handler:           handler,
 		ReadHeaderTimeout: 10 * time.Second,
 		ReadTimeout:       30 * time.Second,
-		// 6 min accommodates /cron/{name}; the webhook handler enforces a
-		// tighter per-update ctx timeout internally.
-		WriteTimeout: 6 * time.Minute,
+		// 75s = cron handler cap (60s, internal/server/timeouts.go) plus a
+		// 15s margin for response serialization. On Lambda the 30s function
+		// timeout supersedes this; the tighter ceiling matters only for
+		// local non-Lambda runs where a 6-minute slow-loris write was the
+		// previous (over-generous) bound.
+		WriteTimeout: 75 * time.Second,
 		IdleTimeout:  120 * time.Second,
 	}