[kit-layout][Audit 2026-04-14] Startup panic paths and resilience defects

[yanghao1143]

Summary

go-saas/kit-layout issues are disabled; tracking this audit item in go-saas/kit.

Findings (kit-layout)

• High | confirmed startup path uses repeated panic(err) and may crash-loop.
  • Evidence: kit-layout/cmd/server/main.go:60, :98, :103, :108, :143, :152
• High | probable defer shutdown() may panic when tracer init fails and shutdown is nil.
  • Evidence: kit-layout/cmd/server/main.go:122, :126
• High | probable nil deref risk in update request when post is nil.
  • Evidence: kit-layout/private/service/post.go:80, :83, :91
• High | probable migration can hit nil DB path.
  • Evidence: kit-layout/private/data/data.go:24, kit-layout/private/data/migrate.go:20, :26
• High | probable default localhost etcd can hard-fail startup.
  • Evidence: kit-layout/configs/config.yaml:20, :21, kit-layout/cmd/server/main.go:143

Suggested Direction

• Replace panic-first startup with controlled errors.
• Guard nil defer/function/data paths.
• Add dependency readiness and fallback options.