Boot panics on short GOOGLE_CLIENT_ID (slice out of range at main.go:64) #106

What

cmd/calnode/main.go:64 logs a prefix of the client ID with no length guard:

slog.Info("Google OAuth configured", "client_id_prefix", cfg.GoogleClientID[:20])

Any non-empty GOOGLE_CLIENT_ID shorter than 20 chars panics the boot with slice out of range. A typo in an env var takes the whole instance down instead of failing config validation.

Fix

Use min(20, len(...)) for the prefix, or better, move the length check into (*config.Config).Validate (main.go:58 already routes bad config there), consistent with the comment at main.go:56-57.

Found by the 0.10.1 pre-release audit (Layer 2, crypto/secrets pass).