fix(backlog): resolve ci/doc drift and harden GUI API

[Microck]

This backlog sweep applies the actionable parts of the current open Nightshift queue.

What changed

• Align CI/release Go version with go.mod (1.25.6) and add explicit read-only workflow permissions.
• Fix docs drift in README/CONTRIBUTING/configuration/release-runbook.
• Harden GUI API: request-size limit, unknown-field rejection, generic external error messages, timed-mode day validation, and omit expiresAt when nil.
• Improve tailscale status parsing error context and include invalid day values in duration validation errors.
• Move auth-key temp-file permission hardening before writing secret content.
• Add regression tests for GUI hardening and tailscale temp-file/validation behavior.

Verification

• go test ./...
• go vet ./...