refactor: common util package, ESL/AMI/security fixes, Prometheus metrics

Backend stability and security improvements:

* internal/util/ — common RandomHex helper, removed 3 duplicates
* ESL: deduplicated readMessage (locked/unlocked), net.JoinHostPort for IPv6
* AMI: synchronous reconnect() in readEventsLoop, net.JoinHostPort for IPv6
* Auth: /api/auth/refresh accepts Authorization header only (no ?token=)
* decodeJSON: http.MaxBytesReader(1<<20) body limit
* Trunks: gatewayParams() uses configured ESL.GatewayPrefix
* Config: jwt_secret_env env-var fallback
* FSCollector: time.After → time.NewTimer with defer Stop
* Monitoring: Prometheus counters (route_requests, nodes_total/healthy, uptime)
* go fmt pass across all internal/ packages

internal/ami/client.go

@@ -63,7 +63,7 @@ func NewClient(host string, port int, username, password string) *Client {
 func (c *Client) Connect() error {
 	c.shouldReconn.Store(true)
 
-	addr := fmt.Sprintf("%s:%d", c.host, c.port)
+	addr := net.JoinHostPort(c.host, fmt.Sprintf("%d", c.port))
 	dialer := net.Dialer{Timeout: 5 * time.Second}
 	conn, err := dialer.Dial("tcp", addr)
 	if err != nil {
@@ -268,11 +268,9 @@ func (c *Client) readEventsLoop() {
 		if err != nil {
 			if err == io.EOF || strings.Contains(err.Error(), "use of closed network connection") {
 				c.connected.Store(false)
-				log.Printf("[ami] соединение разорвано")
-				if c.shouldReconn.Load() {
-					go c.ConnectWithRetry()
-				}
-				return
+				log.Printf("[ami] соединение разорвано, реконнект...")
+				c.reconnect()
+				continue
 			}
 			time.Sleep(100 * time.Millisecond)
 			continue
@@ -291,3 +289,29 @@ func (c *Client) readEventsLoop() {
 		}
 	}
 }
+
+// reconnect выполняет реконнект с backoff (без горутин — синхронный вызов).
+func (c *Client) reconnect() {
+	if !c.shouldReconn.Load() {
+		return
+	}
+	log.Printf("[ami] реконнект через %v...", c.backoff)
+	time.Sleep(c.backoff)
+
+	if c.conn != nil {
+		c.conn.Close()
+		c.conn = nil
+	}
+
+	if err := c.Connect(); err != nil {
+		log.Printf("[ami] реконнект не удался: %v", err)
+		c.backoff *= 2
+		if c.backoff > 60*time.Second {
+			c.backoff = 60 * time.Second
+		}
+		return
+	}
+
+	c.backoff = 1 * time.Second
+	log.Printf("[ami] реконнект успешен")
+}