fix SIP auth, Opus decoder, and CI security gates

[loreste]

Summary

• fixes SIP digest nonce replay sequencing, parser binding, and fail-closed nonce entropy tests
• pins callback HTTP dialing to the validated resolved IP to close DNS rebinding gaps
• replaces the approximate Opus path with a libopus-backed CGO decoder and explicit no-CGO failure
• narrows gosec global exclusions by moving reviewed suppressions to local callsites
• hardens integration CI compose startup with health checks and updates docs for experimental codec/clustering claims

Validation

• gosec include G201,G204,G304,G401,G501: 0 issues
• workflow-equivalent blocking gosec exclude G115,G301,G302,G306,G404: 0 issues
• docker compose -f docker-compose.test.yml config
• go test ./pkg/auth ./pkg/media ./pkg/audio ./pkg/security ./pkg/backup ./pkg/database
• CGO_ENABLED=0 go test ./pkg/media ./pkg/auth
• CGO_ENABLED=1 go test ./pkg/media
• CGO_ENABLED=0/1 go test -run ^$ ./...
• git diff --check

Note: pkg/security listener-dependent tests required rerun outside the sandbox because httptest local bind was blocked there.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ebf60135-c48b-4505-86ee-0a3e497c8ba2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}