feat: complete production readiness improvements

- Fix DIP violations in service layer (device, stats, auth middleware)
- Add ReplaceUserRoles interface method for transaction safety
- Implement Magic Bytes validation for avatar uploads
- Standardize OAuth error handling with ErrOAuthProviderNotSupported
- Use crypto/rand for JWT secret generation instead of weak fixed key
- Apply code formatting with gofumpt and goimports
- Fix staticcheck issues (S1024, S1008, ST1005)
- Add comprehensive quality and functional test reports
- Achieve 36.3% test coverage (up from 16.3%)
- All E2E, integration, and business logic tests passing

internal/repository/device.go

@@ -171,7 +171,7 @@ func (r *DeviceRepository) GetActiveDevices(ctx context.Context, userID int64) (
 // TrustDevice 设置设备为信任状态
 func (r *DeviceRepository) TrustDevice(ctx context.Context, deviceID int64, expiresAt *time.Time) error {
 	updates := map[string]interface{}{
-		"is_trusted":      true,
+		"is_trusted":       true,
 		"trust_expires_at": expiresAt,
 	}
 	return r.db.WithContext(ctx).Model(&domain.Device{}).Where("id = ?", deviceID).Updates(updates).Error
@@ -180,7 +180,7 @@ func (r *DeviceRepository) TrustDevice(ctx context.Context, deviceID int64, expi
 // UntrustDevice 取消设备信任状态
 func (r *DeviceRepository) UntrustDevice(ctx context.Context, deviceID int64) error {
 	updates := map[string]interface{}{
-		"is_trusted":      false,
+		"is_trusted":       false,
 		"trust_expires_at": nil,
 	}
 	return r.db.WithContext(ctx).Model(&domain.Device{}).Where("id = ?", deviceID).Updates(updates).Error