Full codebase audit: 21 security/robustness fixes, 328 tests across 4 packages

Security & economy:
- Credit()/Debit() reject non-positive amounts (closes infinite-money exploit)
- Lottery ticket purchase uses in-transaction count check (closes TOCTOU race)
- Arena bail channel ownership prevents double-close panic
- Entry.ID validated before exec.Command in fetch-esteemed
- Internal errors no longer leaked to users (forex, esteemed)

Robustness:
- safeGo() panic recovery added to 17 goroutine launch sites across 14 plugins
- db.Close() added and called on shutdown
- Miniflux mutex pattern fixed (snapshot-under-lock)
- Silently ignored DB/JSON errors now logged (lottery_db)

Performance:
- Added indexes: idx_arena_runs_user(user_id, status), idx_euro_bal_user(user_id)

UX:
- Empty !buy args shows usage instead of "No item matching ''"
- "Failed to load character" now suggests !adventure

Test coverage:
- internal/util/parser_test.go (19 tests: XP, levels, progress bar, commands, parsing)
- internal/crypto/crypto_test.go (12 tests: encrypt/decrypt, HMAC, ParseKey)
- internal/plugin/helpers_test.go (30 tests: formatNumber, calc, lottery, chat perks)
- internal/plugin/audit_fixes_test.go (25 tests: safeGo, bail channels, error leaks, overflow)
- internal/db/db_test.go (4 tests: Init, Close, schema indexes)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/db/db.go

@@ -56,6 +56,18 @@ func Get() *sql.DB {
 	return globalDB
 }
 
+// Close closes the database connection. Call on shutdown.
+func Close() {
+	mu.Lock()
+	defer mu.Unlock()
+	if globalDB != nil {
+		if err := globalDB.Close(); err != nil {
+			slog.Error("db: close failed", "err", err)
+		}
+		globalDB = nil
+	}
+}
+
 func runMigrations(d *sql.DB) error {
 	if _, err := d.Exec(schema); err != nil {
 		return err
@@ -86,6 +98,8 @@ func runMigrations(d *sql.DB) error {
 		`ALTER TABLE adventure_characters ADD COLUMN combat_actions_used INTEGER NOT NULL DEFAULT 0`,
 		`ALTER TABLE adventure_characters ADD COLUMN harvest_actions_used INTEGER NOT NULL DEFAULT 0`,
 		`ALTER TABLE adventure_characters ADD COLUMN last_pardon_used DATETIME`,
+		`ALTER TABLE arena_runs ADD COLUMN tier_earnings INTEGER NOT NULL DEFAULT 0`,
+		`ALTER TABLE arena_runs ADD COLUMN xp_accumulated INTEGER NOT NULL DEFAULT 0`,
 	}
 	for _, stmt := range columnMigrations {
 		if _, err := d.Exec(stmt); err != nil {
@@ -698,6 +712,8 @@ CREATE TABLE IF NOT EXISTS euro_balances (
 	updated_at   DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
 );
 
+CREATE INDEX IF NOT EXISTS idx_euro_bal_user ON euro_balances(user_id);
+
 CREATE TABLE IF NOT EXISTS euro_transactions (
 	id           INTEGER PRIMARY KEY AUTOINCREMENT,
 	user_id      TEXT NOT NULL,
@@ -1030,6 +1046,8 @@ CREATE TABLE IF NOT EXISTS arena_runs (
 	ended_at        INTEGER
 );
 
+CREATE INDEX IF NOT EXISTS idx_arena_runs_user ON arena_runs(user_id, status);
+
 CREATE TABLE IF NOT EXISTS arena_history (
 	id              INTEGER PRIMARY KEY AUTOINCREMENT,
 	user_id         TEXT NOT NULL,