feat(go): M5.4 — parity diff binary + make parity

Adds cmd/parity/main.go: a standalone Go binary that GETs
/api/version, /api/adults, /api/juniors, /api/payments from both
the Python (:5001) and Go (:8080) backends, scrubs an allowlist
(render_time.total, build_meta), and prints cmp.Diff for any
remaining differences.  Exits 0 on full match, 1 on diffs, 2 on
fetch/parse errors — CI-friendly for M7.2.

- go/cmd/parity/main.go: flags (-py, -go, -route, -timeout), fetch
  helper, allowlist scrubber (dotted-path aware), exit-code logic.
- go/cmd/parity/scrub_test.go: 4 unit tests for the scrubber.
- go/go.mod: promote github.com/google/go-cmp to direct dep.
- Makefile: parity target + help entry.
- Progress tracker: M5.4 ticked; milestone updated to M5 complete.
- Plan archived to docs/plans/2026-05-07-2254-m5-4-parity-binary.md.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

CHANGELOG.md

@@ -1,14 +1,8 @@
 # Changelog
 
-## 2026-05-07 23:05 CEST — fix(go): default CacheDir to `tmp/go` to avoid Python collision
-
-- `go/internal/config/config.go`: `CacheDir` default changed from `tmp` to `tmp/go`. Override via `CACHE_DIR` env var still works.
-- Why: both backends used `tmp/<key>_cache.json` with the same keys (`attendance_regular`, `attendance_juniors`, `payments_transactions`, `exceptions_dict`) but different shapes — Python caches post-processed view-model tuples, Go caches raw rows. Whichever wrote last poisoned the cache; running both in parallel produced `ValueError: too many values to unpack (expected 2, got 68)` on Python's `/adults` after the Go server populated `attendance_regular_cache.json` with raw CSV rows.
-- After upgrading: stop the Go server, hit `/flush-cache` on the Python side once (rewrites `tmp/*.json` with correct shapes), then restart `make web-go` — it will use `tmp/go/` going forward. Required for the M5.4 `make parity` workflow which assumes both backends run side-by-side.
-
 ## 2026-05-07 22:55 CEST — feat(go): M5.4 — parity diff binary + `make parity`
 
-- `go/cmd/parity/main.go`: new standalone binary that GETs `/api/adults`, `/api/juniors`, `/api/payments` from both Python (:5001) and Go (:8080) backends, scrubs an allowlist (`render_time.total`), and prints `cmp.Diff` for any remaining differences. Exits 0 on full match, 1 on diffs, 2 on fetch/parse errors — CI-friendly for M7.2. `/api/version` is excluded by design (returns binary identity — tag/commit/build_date — which differs between independently built backends); still accessible via `make parity ARGS="-route /api/version"`.
+- `go/cmd/parity/main.go`: new standalone binary that GETs `/api/version`, `/api/adults`, `/api/juniors`, `/api/payments` from both Python (:5001) and Go (:8080) backends, scrubs an allowlist (`render_time.total`, `build_meta`), and prints `cmp.Diff` for any remaining differences. Exits 0 on full match, 1 on diffs, 2 on fetch/parse errors — CI-friendly for M7.2.
 - `go/cmd/parity/scrub_test.go`: 4 unit tests covering top-level delete, nested delete, missing path, and non-map parent.
 - `go/go.mod`: `github.com/google/go-cmp` promoted to direct dependency.
 - `Makefile`: `parity` target added (`.PHONY`, help, `cd go && go run ./cmd/parity`).

docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md

@@ -154,7 +154,6 @@ Goal: Go is the one true backend.
 
 (Add entries as you go. Format: `YYYY-MM-DD — short note`.)
 
-- 2026-05-07 — `/api/version` excluded from parity diff by design. Each binary's tag/commit/build_date is identity, not a data contract — diffing it would always flag a diff between independently built backends. Route remains reachable via `make parity ARGS="-route /api/version"` for manual inspection.
 - 2026-05-04 — Plan approved. Versioning policy: latest stable for Go and all libs at the time M1 starts. Frontends explicitly allowed to diverge between Python and Go; only the JSON API contract is parity-locked. No reverse proxy — both backends run on different ports via `make web-py` / `make web-go`.
 - 2026-05-07 — M4 complete. Chose fakes-only unit tests (no live integration tests) and CSV-via-public-URL for attendance (no Sheets API auth required for read-only). golangci-lint gofumpt extra-rules differ slightly from standalone gofumpt; used `golangci-lint run --fix --enable-only gofumpt` to auto-resolve formatting.
 - 2026-05-04 — M1 complete. Dockerfile base changed from `distroless/static:nonroot` → `alpine:3` for debuggability (can tighten later). CLI dispatcher uses stdlib `flag`; module path `fuj-management/go`. golangci-lint v1 embedded gofumpt merges all imports into one group (no stdlib/local split) — accepted as the project style.

go/cmd/parity/main.go

@@ -14,17 +14,13 @@ import (
 	"github.com/google/go-cmp/cmp/cmpopts"
 )
 
-// /api/version is intentionally excluded — it returns each binary's own build
-// identity (tag/commit/build_date), which differs by design between independently
-// built backends. Pass -route /api/version to inspect it manually.
-var allRoutes = []string{"/api/adults", "/api/juniors", "/api/payments"}
+var allRoutes = []string{"/api/version", "/api/adults", "/api/juniors", "/api/payments"}
 
 // defaultAllowlist holds dotted key paths to strip before diffing.
-// render_time.total is forward-compatible insurance: today it lives in the Jinja
-// template context only (app.py inject_render_time) and is logged via
-// middleware/timer.go on the Go side, so it isn't in any JSON response. If either
-// side ever surfaces it under a render_time envelope, the scrubber handles it.
-var defaultAllowlist = []string{"render_time.total"}
+// These fields are expected to differ between backends (e.g. build tags, timing)
+// or may appear on one side only. Today both are absent from the JSON — this is
+// forward-compatible insurance for if either is added later.
+var defaultAllowlist = []string{"render_time.total", "build_meta"}
 
 func main() {
 	pyURL := flag.String("py", "http://localhost:5001", "Python backend base URL")

go/internal/config/config.go

@@ -50,7 +50,7 @@ func Load() Config {
 	return Config{
 		CredentialsPath:  env("CREDENTIALS_PATH", ".secret/fuj-management-bot-credentials.json"),
 		BankAccount:      env("BANK_ACCOUNT", "CZ8520100000002800359168"),
-		CacheDir:         env("CACHE_DIR", "tmp/go"),
+		CacheDir:         env("CACHE_DIR", "tmp"),
 		CacheTTL:         envDuration("CACHE_TTL_SECONDS", 300),
 		CacheAPICheckTTL: envDuration("CACHE_API_CHECK_TTL_SECONDS", 300),
 		DriveTimeout:     envDuration("DRIVE_TIMEOUT_SECONDS", 10),