fix: review findings (async SQS dispatcher, backoff, batch insert, shutdown order, pagination, HMAC) + loadtest fixes; v0.1.6

internal/service/api/handler/devices.go

@@ -15,6 +15,7 @@ import (
 	"encoding/json"
 	"errors"
 	"net/http"
+	"strconv"
 	"time"
 
 	"gitea.services.ngcloud.ru/Nail/IoT/internal/service/store"
@@ -72,12 +73,19 @@ func deviceToResponse(d *store.Device, password string) iotDeviceResponse {
 }
 
 // generateMQTTPassword — 32 случайных байта в hex (как старый контроллер).
+// crypto/rand ошибку даёт только при сбое системного PRNG — 3 попытки
+// (ревью 2026-08-16: не возвращать пустой пароль).
 func generateMQTTPassword() (string, error) {
-	buf := make([]byte, 32)
-	if _, err := rand.Read(buf); err != nil {
-		return "", err
+	var lastErr error
+	for attempt := 0; attempt < 3; attempt++ {
+		buf := make([]byte, 32)
+		if _, err := rand.Read(buf); err == nil {
+			return hex.EncodeToString(buf), nil
+		} else {
+			lastErr = err
+		}
 	}
-	return hex.EncodeToString(buf), nil
+	return "", lastErr
 }
 
 // CreateIoTDevice — POST /v1/namespaces/{ns}/iot/devices.
@@ -142,13 +150,17 @@ func (h *Handler) CreateIoTDevice(w http.ResponseWriter, r *http.Request) {
 }
 
 // ListIoTDevices — GET /v1/namespaces/{ns}/iot/devices (без паролей).
+// Пагинация: ?limit=N&offset=M (0 = без ограничения).
 func (h *Handler) ListIoTDevices(w http.ResponseWriter, r *http.Request) {
 	ns := pathVar(r, "namespace")
 	if ns == "" {
 		ns = "default"
 	}
 
-	devices, err := h.Devices.List(r.Context(), ns)
+	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
+	offset, _ := strconv.Atoi(r.URL.Query().Get("offset"))
+
+	devices, err := h.Devices.List(r.Context(), ns, limit, offset)
 	if err != nil {
 		h.Log.Error("list devices", "namespace", ns, "err", err)
 		writeJSON(w, http.StatusInternalServerError, errResp("failed to list devices"))

internal/service/api/handler/telemetry.go

@@ -25,8 +25,14 @@ func (h *Handler) ListIoTTelemetry(w http.ResponseWriter, r *http.Request) {
 			limit = n
 		}
 	}
+	offset := 0
+	if os := r.URL.Query().Get("offset"); os != "" {
+		if n, err := strconv.Atoi(os); err == nil && n >= 0 {
+			offset = n
+		}
+	}
 
-	rows, err := h.IoTPG.QueryTelemetry(r.Context(), ns, deviceID, limit)
+	rows, err := h.IoTPG.QueryTelemetry(r.Context(), ns, deviceID, limit, offset)
 	if err != nil {
 		h.Log.Error("query IoT telemetry", "namespace", ns, "device", deviceID, "err", err)
 		writeJSON(w, http.StatusInternalServerError, errResp("failed to query telemetry"))