fix connection handlers, group ops, and various HTTP handler bugs

buglist.md

@@ -0,0 +1,35 @@
+# Bug List
+
+## Open
+
+### Bug 1 — `WsSendToUser`: sends message to sender, not recipient
+**File:** `wsServer.go:86`
+`to *User` parameter is never used — message is sent back to `from` instead.
+```go
+sendMessageCloseIfTimeout(from, &msg)  // should be `to`
+```
+
+### Bug 2 — `ServeWsConnection`: `ignoreCache` captured by value in defer
+**File:** `wsServer.go:30`
+`ignoreCache` is `false` at defer registration; setting it to `true` later has no effect.
+The user is always evicted from cache on disconnect.
+```go
+defer closeConnection(&user, ignoreCache)        // wrong
+defer func() { closeConnection(&user, ignoreCache) }()  // correct
+```
+
+### Bug 3 — Deadlock in `sendToAllMessageCloseIfTimeout`
+**File:** `wsServer.go:72`, `cache.go:52`
+`sendToAllMessageCloseIfTimeout` holds `mu.RLock()`, calls `sendMessageCloseIfTimeout`,
+which on timeout calls `closeConnection` → `CacheDeleteUser` → `mu.Lock()`.
+Upgrading RLock to write Lock deadlocks.
+
+### Bug 4 — `closeConnection`: nil `WsConn` not guarded
+**File:** `wsServer.go:179`
+`user.WsConn.CloseNow()` panics if `WsConn` is nil (e.g. unauthenticated user).
+`sendMessageCloseIfTimeout` guards against this but `closeConnection` does not.
+
+### Bug 5 — `HttpHandleUserAcceptConnection`: potential nil dereference
+**File:** `http.go:410`
+`target.Connections[user.Id].IsAccepted = true` panics if the entry is missing
+(DB inconsistency). The sender side is guarded but the recipient side is not.