chore: fix staticcheck U1000 unused code warnings

- Remove unused ipv6Regex from validation.go
- Suppress unused recordAlertFired/recordAlertResolved hooks (kept for future use)
- Remove unused apiLimiter rate limiter
- Remove unused stopOnce fields from csrf_store.go and session_store.go
- Remove unused lastBroadcast field from hub.go
- Remove unused lastUsedIndex field from cluster_client.go

cmd/pulse-sensor-proxy/validation.go

@@ -23,9 +23,6 @@ var (
 
 	// ipv4Regex validates IPv4 addresses
 	ipv4Regex = regexp.MustCompile(`^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$`)
-
-	// ipv6Regex validates IPv6 addresses (simplified)
-	ipv6Regex = regexp.MustCompile(`^[0-9a-fA-F:]+$`)
 )
 
 var (

internal/alerts/alerts.go

@@ -431,12 +431,15 @@ var (
 	recordAlertAcknowledged func()
 )
 
-// SetMetricHooks registers callbacks for recording alert metrics
+// SetMetricHooks registers callbacks for recording alert metrics.
+// Note: fired and resolved callbacks are stored for future use but not yet wired into alert lifecycle.
 func SetMetricHooks(fired func(*Alert), resolved func(*Alert), suppressed func(string), acknowledged func()) {
 	recordAlertFired = fired
 	recordAlertResolved = resolved
 	recordAlertSuppressed = suppressed
 	recordAlertAcknowledged = acknowledged
+	// Silence staticcheck U1000 - hooks are stored for future metric integration
+	_, _ = recordAlertFired, recordAlertResolved
 }
 
 type Manager struct {

internal/api/csrf_store.go

@@ -29,7 +29,6 @@ type CSRFTokenStore struct {
 	dataPath   string
 	saveTicker *time.Ticker
 	stopChan   chan bool
-	stopOnce   sync.Once // Ensures Stop() can only close channel once
 }
 
 func csrfSessionKey(sessionID string) string {

internal/api/security.go

@@ -123,9 +123,6 @@ func issueNewCSRFCookie(w http.ResponseWriter, r *http.Request, sessionID string
 var (
 	// Auth endpoints: 10 attempts per minute
 	authLimiter = NewRateLimiter(10, 1*time.Minute)
-
-	// General API: 500 requests per minute (increased for metadata endpoints)
-	apiLimiter = NewRateLimiter(500, 1*time.Minute)
 )
 
 // GetClientIP extracts the client IP from the request

internal/api/session_store.go

@@ -19,7 +19,6 @@ type SessionStore struct {
 	dataPath   string
 	saveTicker *time.Ticker
 	stopChan   chan bool
-	stopOnce   sync.Once // Ensures Stop() can only close channel once
 }
 
 func sessionHash(token string) string {

internal/websocket/hub.go

@@ -277,7 +277,6 @@ type Hub struct {
 	getState       func() interface{} // Function to get current state
 	allowedOrigins []string           // Allowed origins for CORS
 	// Broadcast coalescing fields
-	lastBroadcast   time.Time
 	coalesceWindow  time.Duration
 	coalescePending *Message
 	coalesceTimer   *time.Timer

pkg/proxmox/cluster_client.go

@@ -22,7 +22,6 @@ type ClusterClient struct {
 	nodeHealth      map[string]bool      // Track node health
 	lastHealthCheck map[string]time.Time // Track last health check time
 	lastError       map[string]string    // Track last error per endpoint
-	lastUsedIndex   int                  // For round-robin
 	config          ClientConfig         // Base config (auth info)
 	rateLimitUntil  map[string]time.Time // Cooldown window for rate-limited endpoints
 }