fix(api): prevent panic on 204 No Content responses with Go 1.26

Go 1.26 enforces that response status codes like 204 No Content
must not have a body. The OTLP middleware's finalize() method was
calling Write() even with empty data, causing a panic. Additionally,
NoContent() was routing through writeJSON() which unnecessarily set
Content-Type header on bodyless responses.

Constraint: Go 1.26 strictly enforces RFC 7230 no-body status codes
Rejected: Recover from panic in finalize | masks the root cause
Confidence: high
Scope-risk: narrow

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: sylr

pkg/transport/api/utils.go

@@ -41,7 +41,7 @@ func NotFound(w http.ResponseWriter, err error) {
 }
 
 func NoContent(w http.ResponseWriter) {
-	writeJSON(w, http.StatusNoContent, nil)
+	w.WriteHeader(http.StatusNoContent)
 }
 
 func Forbidden(w http.ResponseWriter, code string, err error) {

pkg/transport/httpserver/otlp_middleware.go

@@ -26,6 +26,9 @@ func (w *responseWriter) finalize() {
 	if w.Header().Get("Content-Type") == "application/octet-stream" {
 		return
 	}
+	if len(w.data) == 0 {
+		return
+	}
 	_, err := w.ResponseWriter.Write(w.data)
 	if err != nil {
 		panic(err)