chore: PR review — identify dead code and style issues in scan tracking feature

[Copilot]

Responded to a PR review request on the scan tracking feature (Feat/add scans). No code changes were made; this is a review reply only.

Findings

• Dead code — Settings.GetScanStats() is defined in the interface, implemented in settings.go, and mocked, but never called. Scan stats are read exclusively through Scans.GetStats() which reads scan_stats from the settings table directly. Safe to remove.

• Swagger annotation style inconsistency — getScanTypesHandler in scans.go uses the old //\n//\t@Summary indented format; the other four handlers in the same file use // @Summary. Should be unified.

• Mismatched Go doc comment — // SAQs embeds questions in the response for the hacker sits above type ApplicationWithQuestions struct. Go doc comments must start with the exported identifier name.

• Stripped first-line handler doc comments — Descriptive first-line comments (e.g. // getOrCreateApplicationHandler returns...) were removed from handlers in applications.go, auth.go, reviews.go, and settings.go. Godoc uses these as the function summary.

• Counter cache drift risk — scan_stats is only incremented on scan creation with no reconciliation path. Any out-of-band DB modification (direct SQL fix, migration rollback/replay) will permanently diverge the counter from actual row counts. Worth a /admin/scans/stats/recalculate endpoint or similar safety valve.

• Redundant index — idx_scans_user_id in migration 000013 is redundant; UNIQUE(user_id, scan_type) already creates a composite index with user_id as the leading column.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.