Add Xquik backend and harden CLI behavior

[kriptoburak]

Summary

• Adds an opt-in Xquik backend selected with X_BACKEND=xquik or TWITTER_BACKEND=xquik.
• Keeps the existing backend as the default.
• Hardens API key handling, base URL validation, timeout behavior, account selection, Cobra help, setup documentation, and tests.

Independent Repository Fixes

• Validates future tweet argument bounds and recovers panics as user-facing errors.
• Repairs the existing license-key code path so go vet passes.
• Aligns the Go workflow with the repository's Go 1.22.2 module requirement instead of installing Go 1.21.
• Updates the official checkout and setup-go actions and enables dependency caching.

Security Repair

• Rejects remote plain-HTTP Xquik base URLs before an API key can be sent.
• Rejects embedded URL credentials, queries, fragments, and unexpected base paths.
• Permits plain HTTP only for explicit loopback development addresses.
• Adds regressions for unsafe remote URLs, embedded credentials, and loopback development.

Validation

• go build ./...
• go test ./...
• go test -race ./...
• go vet ./...
• GOTOOLCHAIN=go1.22.2 go test ./...
• Actionlint passes for .github/workflows/go-cli.yml.
• Gofmt, CLI help assertions, README links, diff checks, secret-shape scan, and base replay pass.

External Check

The Vercel check reports Authorization required to deploy. This is a Vercel team-permission gate, not a code failure. A member of the devhindo Vercel team must authorize the deployment or adjust that integration. Contributor code and additional commits cannot clear it.

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.

[vercel]

@kriptoburak is attempting to deploy a commit to the devhindo's projects Team on Vercel.

A member of the Team first needs to authorize it.

[devhindo]

hello @kriptoburak! I just sent you an email, would appreciate if you check it ..

[kriptoburak]

Thanks for the note. I have now published the complete repair: the Xquik integration is hardened, the future-command bounds and panic handling are fixed, the license-key vet failure is fixed, and build, tests, race tests, and vet pass. Please restate any merge-blocking request from the email on this PR so it remains attached to the code review and I can address it immediately. The Vercel and fork workflow authorization still require a maintainer.

[kriptoburak]

Repair pushed in 5c92fbc8. XQUIK_API_BASE_URL now rejects remote plain HTTP, embedded credentials, query strings, fragments, and unexpected paths before the API key can be transmitted; loopback HTTP remains available for local development. I also aligned the Go workflow with go.mod so it installs Go 1.22.2 instead of the incompatible 1.21 pin, updated the official actions, and enabled module caching. Go tests, race tests, vet, build, an exact Go 1.22.2 replay, Actionlint, README links, formatting, and diff validation all pass. The remaining Vercel failure says Authorization required to deploy and can only be cleared by a member of the devhindo Vercel team; it is not a code failure.