Adopt the shared .golangci.yml and fix the code to it (closes #6)

Vendor .golangci.yml byte-identical from sneak/prompts at cc440118 and
move the Dockerfile lint phase to golangci-lint v2.14.0 by the digest
REPO_POLICIES.md names. Fix the code to that config with flags, help
text, output files, SQL and the order of steps unchanged; long
functions are split into named steps.

Judgement call: the extraction transaction is now rolled back on every
early return; the old deferred rollback missed most failures and could
dereference a nil transaction.
Thirteen //nolint directives (gosec, unconvert, mnd, unqueryvet), each
with its reason.

Model: opus-5-5

README.md

@@ -35,9 +35,9 @@ issues are [tracked there](https://git.eeqj.de/sneak/bsdaily/issues).
 
 Changes must always be formatted with `make fmt` (`go fmt` for Go, prettier for
 Markdown), syntactically valid, and must pass the linting defined in the
-repository (presently the `golangci-lint` defaults), which can be run with a
-`make lint`. The `main` branch is protected and all changes must be made via
-[pull requests](https://git.eeqj.de/sneak/bsdaily/pulls) and pass CI to be
+repository (the shared `.golangci.yml` from `sneak/prompts`), which can be run
+with a `make lint`. The `main` branch is protected and all changes must be made
+via [pull requests](https://git.eeqj.de/sneak/bsdaily/pulls) and pass CI to be
 merged.
 
 See [`REPO_POLICIES.md`](REPO_POLICIES.md) for detailed coding standards,