fix(server): errcheck violations from UPnP slice

golangci-lint flagged three errcheck:
- stream_token.go: fmt.Fprintf(mac, ...) - hash.Hash never errors
  per documented contract, but errcheck wants explicit discard.
  Discard via _, _ assignment with a WHY comment.
- config_test.go: os.Unsetenv calls in tests - discard the error
  via _ assignment. Test cleanup paths.

Reviewers flagged the Fprintf one during Task 1 quality review but
golangci-lint runs in a separate CI step that wasn't exercised on
the per-task pushes (cancelled by subsequent push concurrency).

internal/api/stream_token.go

@@ -21,7 +21,8 @@ import (
 // loader and the stream handler share.
 func SignStreamToken(secret []byte, trackID string, exp int64) string {
 	mac := hmac.New(sha256.New, secret)
-	fmt.Fprintf(mac, "%s|%d", trackID, exp)
+	// hash.Hash.Write is documented as never returning an error.
+	_, _ = fmt.Fprintf(mac, "%s|%d", trackID, exp)
 	return hex.EncodeToString(mac.Sum(nil))
 }
 

internal/config/config_test.go

@@ -201,7 +201,7 @@ func TestStreamSecret_EnvOverride(t *testing.T) {
 }
 
 func TestStreamSecret_AutoGenPersistsToDataDir(t *testing.T) {
-	os.Unsetenv("MINSTREL_STREAM_SECRET")
+	_ = os.Unsetenv("MINSTREL_STREAM_SECRET")
 	dataDir := t.TempDir()
 	t.Setenv("MINSTREL_STORAGE_DATA_DIR", dataDir)
 
@@ -235,7 +235,7 @@ func TestStreamSecret_AutoGenPersistsToDataDir(t *testing.T) {
 }
 
 func TestStreamSecret_LoadsPersistedOnSecondBoot(t *testing.T) {
-	os.Unsetenv("MINSTREL_STREAM_SECRET")
+	_ = os.Unsetenv("MINSTREL_STREAM_SECRET")
 	dataDir := t.TempDir()
 	t.Setenv("MINSTREL_STORAGE_DATA_DIR", dataDir)