fix: resolve 43 lint findings blocking CI

- server.go: drop unused (*Server).serve int return (unparam) and
  remove the dead exitCode field so cleanShutdown no longer writes
  to a field nothing reads.
- service.go: rename range var ch -> modeChar in parseUserModeString
  and the isKnownUserModeChar parameter (varnamelen).
- service_test.go: rename tc -> testCase (varnamelen); lift the
  inline struct and caseState to package-level named types
  (applyUserModeCase, applyUserModeCaseState) with every field
  set explicitly (exhaustruct); split the 167-line case table into
  four categorised helpers (funlen); extract the per-case runner
  and outcome/state verifiers into helpers so TestApplyUserMode
  drops below gocognit 30 and flattens the wantErr nestif block.

No changes to .golangci.yml, Makefile, Dockerfile, or CI config.
No //nolint was used to silence any of these findings.

docker build --no-cache . passes clean: 0 lint issues, all tests
pass with -race, binary compiles.

internal/server/server.go

@@ -45,7 +45,6 @@ type Params struct {
 // It manages routing, middleware, and lifecycle.
 type Server struct {
 	startupTime   time.Time
-	exitCode      int
 	sentryEnabled bool
 	log           *slog.Logger
 	ctx           context.Context //nolint:containedctx // signal handling pattern
@@ -143,7 +142,7 @@ func (srv *Server) enableSentry() {
 	srv.sentryEnabled = true
 }
 
-func (srv *Server) serve() int {
+func (srv *Server) serve() {
 	srv.ctx, srv.cancelFunc = context.WithCancel(
 		context.Background(),
 	)
@@ -168,8 +167,6 @@ func (srv *Server) serve() int {
 	<-srv.ctx.Done()
 
 	srv.cleanShutdown()
-
-	return srv.exitCode
 }
 
 func (srv *Server) cleanupForExit() {
@@ -177,8 +174,6 @@ func (srv *Server) cleanupForExit() {
 }
 
 func (srv *Server) cleanShutdown() {
-	srv.exitCode = 0
-
 	ctxShutdown, shutdownCancel := context.WithTimeout(
 		context.Background(), shutdownTimeout,
 	)