Full codebase audit: 21 security/robustness fixes, 328 tests across 4 packages

Security & economy:
- Credit()/Debit() reject non-positive amounts (closes infinite-money exploit)
- Lottery ticket purchase uses in-transaction count check (closes TOCTOU race)
- Arena bail channel ownership prevents double-close panic
- Entry.ID validated before exec.Command in fetch-esteemed
- Internal errors no longer leaked to users (forex, esteemed)

Robustness:
- safeGo() panic recovery added to 17 goroutine launch sites across 14 plugins
- db.Close() added and called on shutdown
- Miniflux mutex pattern fixed (snapshot-under-lock)
- Silently ignored DB/JSON errors now logged (lottery_db)

Performance:
- Added indexes: idx_arena_runs_user(user_id, status), idx_euro_bal_user(user_id)

UX:
- Empty !buy args shows usage instead of "No item matching ''"
- "Failed to load character" now suggests !adventure

Test coverage:
- internal/util/parser_test.go (19 tests: XP, levels, progress bar, commands, parsing)
- internal/crypto/crypto_test.go (12 tests: encrypt/decrypt, HMAC, ParseKey)
- internal/plugin/helpers_test.go (30 tests: formatNumber, calc, lottery, chat perks)
- internal/plugin/audit_fixes_test.go (25 tests: safeGo, bail channels, error leaks, overflow)
- internal/db/db_test.go (4 tests: Init, Close, schema indexes)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/plugin/miniflux.go

@@ -116,11 +116,11 @@ func (p *MinifluxPlugin) OnMessage(ctx MessageContext) error {
 
 	switch sub {
 	case "feeds":
-		go func() {
+		safeGo("miniflux-feeds", func() {
 			if err := p.cmdFeeds(ctx); err != nil {
 				slog.Error("miniflux: feeds error", "err", err)
 			}
-		}()
+		})
 		return nil
 	case "subscribe":
 		if !p.IsAdmin(ctx.Sender) {
@@ -135,11 +135,11 @@ func (p *MinifluxPlugin) OnMessage(ctx MessageContext) error {
 	case "subscriptions":
 		return p.cmdSubscriptions(ctx)
 	case "latest":
-		go func() {
+		safeGo("miniflux-latest", func() {
 			if err := p.cmdLatest(ctx, parts[1:]); err != nil {
 				slog.Error("miniflux: latest error", "err", err)
 			}
-		}()
+		})
 		return nil
 	case "pause":
 		if !p.IsAdmin(ctx.Sender) {
@@ -586,11 +586,11 @@ func (p *MinifluxPlugin) poll() {
 	}
 
 	p.mu.Lock()
-	if p.pollingDisabled {
-		p.mu.Unlock()
+	disabled := p.pollingDisabled
+	p.mu.Unlock()
+	if disabled {
 		return
 	}
-	p.mu.Unlock()
 
 	// Get all active (non-paused) subscriptions
 	d := db.Get()