[Quality] Code quality issues — inconsistent errors, magic numbers, missing CORS, go version

[daviddao]

Review Findings: 5a-5d — LOW

5a. Inconsistent Error Handling

• Some errors silently logged then continue: slog.Warn("Failed...", "error", err)
• Some errors swallowed: return nil //nolint:nilerr
• fmt.Printf used instead of slog in one place (resolvers.go:98)

5b. go 1.25 in go.mod

Go 1.25 doesn't exist yet (as of early 2026). This is either aspirational or incorrect.

5c. Magic Numbers

Hardcoded values throughout: batch sizes (100, 900, 1000), buffer sizes (100, 1000), timeouts. These should be constants or configurable.

5d. Missing CORS Headers

No CORS middleware configured. The GraphQL and admin endpoints will be unusable from browser-based clients without proper CORS.

Fix

1. Establish consistent error handling policy (log+return vs. log+continue)
2. Fix go.mod version
3. Extract magic numbers to named constants
4. Add configurable CORS middleware

From codebase review §5a-5d