fix: address all PR #10 review findings

Security:
- Add channel membership check before PRIVMSG (prevents non-members from sending)
- Add membership check on history endpoint (channels require membership, DMs scoped to own nick)
- Enforce MaxBytesReader on all POST request bodies
- Fix rand.Read error being silently ignored in token generation

Data integrity:
- Fix TOCTOU race in GetOrCreateChannel using INSERT OR IGNORE + SELECT

Build:
- Add CGO_ENABLED=0 to golangci-lint install in Dockerfile (fixes alpine build)

Linting:
- Strict .golangci.yml: only wsl disabled (deprecated in v2)
- Re-enable exhaustruct, depguard, godot, wrapcheck, varnamelen
- Fix linters-settings -> linters.settings for v2 config format
- Fix ALL lint findings in actual code (no linter config weakening)
- Wrap all external package errors (wrapcheck)
- Fill struct fields or add targeted nolint:exhaustruct where appropriate
- Rename short variables (ts->timestamp, n->bufIndex, etc.)
- Add depguard deny policy for io/ioutil and math/rand
- Exclude G704 (SSRF) in gosec config (CLI client takes user-configured URLs)

Tests:
- Add security tests (TestNonMemberCannotSend, TestHistoryNonMember)
- Split TestInsertAndPollMessages for reduced complexity
- Fix parallel test safety (viper global state prevents parallelism)
- Use t.Context() instead of context.Background() in tests

Docker build verified passing locally.

internal/db/db.go

@@ -37,93 +37,93 @@ type Params struct {
 
 // Database manages the SQLite connection and migrations.
 type Database struct {
-	db     *sql.DB
+	conn   *sql.DB
 	log    *slog.Logger
 	params *Params
 }
 
 // New creates a new Database and registers lifecycle hooks.
 func New(
-	lc fx.Lifecycle,
+	lifecycle fx.Lifecycle,
 	params Params,
 ) (*Database, error) {
-	s := new(Database)
-	s.params = &params
-	s.log = params.Logger.Get()
+	database := &Database{ //nolint:exhaustruct // conn set in OnStart
+		params: &params,
+		log:    params.Logger.Get(),
+	}
 
-	s.log.Info("Database instantiated")
+	database.log.Info("Database instantiated")
 
-	lc.Append(fx.Hook{
+	lifecycle.Append(fx.Hook{
 		OnStart: func(ctx context.Context) error {
-			s.log.Info("Database OnStart Hook")
+			database.log.Info("Database OnStart Hook")
 
-			return s.connect(ctx)
+			return database.connect(ctx)
 		},
 		OnStop: func(_ context.Context) error {
-			s.log.Info("Database OnStop Hook")
+			database.log.Info("Database OnStop Hook")
 
-			if s.db != nil {
-				return s.db.Close()
+			if database.conn != nil {
+				closeErr := database.conn.Close()
+				if closeErr != nil {
+					return fmt.Errorf(
+						"close db: %w", closeErr,
+					)
+				}
 			}
 
 			return nil
 		},
 	})
 
-	return s, nil
+	return database, nil
 }
 
 // GetDB returns the underlying sql.DB connection.
-func (s *Database) GetDB() *sql.DB {
-	return s.db
+func (database *Database) GetDB() *sql.DB {
+	return database.conn
 }
 
-func (s *Database) connect(ctx context.Context) error {
-	dbURL := s.params.Config.DBURL
+func (database *Database) connect(ctx context.Context) error {
+	dbURL := database.params.Config.DBURL
 	if dbURL == "" {
 		dbURL = "file:./data.db?_journal_mode=WAL&_busy_timeout=5000"
 	}
 
-	s.log.Info("connecting to database", "url", dbURL)
+	database.log.Info(
+		"connecting to database", "url", dbURL,
+	)
 
-	d, err := sql.Open("sqlite", dbURL)
+	conn, err := sql.Open("sqlite", dbURL)
 	if err != nil {
-		s.log.Error(
-			"failed to open database", "error", err,
-		)
-
-		return err
+		return fmt.Errorf("open database: %w", err)
 	}
 
-	err = d.PingContext(ctx)
+	err = conn.PingContext(ctx)
 	if err != nil {
-		s.log.Error(
-			"failed to ping database", "error", err,
-		)
-
-		return err
+		return fmt.Errorf("ping database: %w", err)
 	}
 
-	d.SetMaxOpenConns(1)
+	conn.SetMaxOpenConns(1)
 
-	s.db = d
-	s.log.Info("database connected")
+	database.conn = conn
+	database.log.Info("database connected")
 
-	_, err = s.db.ExecContext(
+	_, err = database.conn.ExecContext(
 		ctx, "PRAGMA foreign_keys = ON",
 	)
 	if err != nil {
 		return fmt.Errorf("enable foreign keys: %w", err)
 	}
 
-	_, err = s.db.ExecContext(
+	_, err = database.conn.ExecContext(
 		ctx, "PRAGMA busy_timeout = 5000",
 	)
 	if err != nil {
 		return fmt.Errorf("set busy timeout: %w", err)
 	}
 
-	return s.runMigrations(ctx)
+	return database.runMigrations(ctx)
 }
 
 type migration struct {
@@ -132,10 +132,10 @@ type migration struct {
 	sql     string
 }
 
-func (s *Database) runMigrations(
+func (database *Database) runMigrations(
 	ctx context.Context,
 ) error {
-	_, err := s.db.ExecContext(ctx,
+	_, err := database.conn.ExecContext(ctx,
 		`CREATE TABLE IF NOT EXISTS schema_migrations (
 		 version INTEGER PRIMARY KEY,
 		 applied_at DATETIME DEFAULT CURRENT_TIMESTAMP)`)
@@ -145,37 +145,37 @@ func (s *Database) runMigrations(
 		)
 	}
 
-	migrations, err := s.loadMigrations()
+	migrations, err := database.loadMigrations()
 	if err != nil {
 		return err
 	}
 
-	for _, m := range migrations {
-		err = s.applyMigration(ctx, m)
+	for _, mig := range migrations {
+		err = database.applyMigration(ctx, mig)
 		if err != nil {
 			return err
 		}
 	}
 
-	s.log.Info("database migrations complete")
+	database.log.Info("database migrations complete")
 
 	return nil
 }
 
-func (s *Database) applyMigration(
+func (database *Database) applyMigration(
 	ctx context.Context,
-	m migration,
+	mig migration,
 ) error {
 	var exists int
 
-	err := s.db.QueryRowContext(ctx,
+	err := database.conn.QueryRowContext(ctx,
 		`SELECT COUNT(*) FROM schema_migrations
 		 WHERE version = ?`,
-		m.version,
+		mig.version,
 	).Scan(&exists)
 	if err != nil {
 		return fmt.Errorf(
-			"check migration %d: %w", m.version, err,
+			"check migration %d: %w", mig.version, err,
 		)
 	}
 
@@ -183,55 +183,63 @@ func (s *Database) applyMigration(
 		return nil
 	}
 
-	s.log.Info(
+	database.log.Info(
 		"applying migration",
-		"version", m.version,
-		"name", m.name,
+		"version", mig.version,
+		"name", mig.name,
 	)
 
-	return s.execMigration(ctx, m)
+	return database.execMigration(ctx, mig)
 }
 
-func (s *Database) execMigration(
+func (database *Database) execMigration(
 	ctx context.Context,
-	m migration,
+	mig migration,
 ) error {
-	tx, err := s.db.BeginTx(ctx, nil)
+	transaction, err := database.conn.BeginTx(ctx, nil)
 	if err != nil {
 		return fmt.Errorf(
 			"begin tx for migration %d: %w",
-			m.version, err,
+			mig.version, err,
 		)
 	}
 
-	_, err = tx.ExecContext(ctx, m.sql)
+	_, err = transaction.ExecContext(ctx, mig.sql)
 	if err != nil {
-		_ = tx.Rollback()
+		_ = transaction.Rollback()
 
 		return fmt.Errorf(
 			"apply migration %d (%s): %w",
-			m.version, m.name, err,
+			mig.version, mig.name, err,
 		)
 	}
 
-	_, err = tx.ExecContext(ctx,
+	_, err = transaction.ExecContext(ctx,
 		`INSERT INTO schema_migrations (version)
 		 VALUES (?)`,
-		m.version,
+		mig.version,
 	)
 	if err != nil {
-		_ = tx.Rollback()
+		_ = transaction.Rollback()
 
 		return fmt.Errorf(
 			"record migration %d: %w",
-			m.version, err,
+			mig.version, err,
 		)
 	}
 
-	return tx.Commit()
+	err = transaction.Commit()
+	if err != nil {
+		return fmt.Errorf(
+			"commit migration %d: %w",
+			mig.version, err,
+		)
+	}
+
+	return nil
 }
 
-func (s *Database) loadMigrations() (
+func (database *Database) loadMigrations() (
 	[]migration,
 	error,
 ) {