fix: resolve 43 lint findings blocking CI

- server.go: drop unused (*Server).serve int return (unparam) and
  remove the dead exitCode field so cleanShutdown no longer writes
  to a field nothing reads.
- service.go: rename range var ch -> modeChar in parseUserModeString
  and the isKnownUserModeChar parameter (varnamelen).
- service_test.go: rename tc -> testCase (varnamelen); lift the
  inline struct and caseState to package-level named types
  (applyUserModeCase, applyUserModeCaseState) with every field
  set explicitly (exhaustruct); split the 167-line case table into
  four categorised helpers (funlen); extract the per-case runner
  and outcome/state verifiers into helpers so TestApplyUserMode
  drops below gocognit 30 and flattens the wantErr nestif block.

No changes to .golangci.yml, Makefile, Dockerfile, or CI config.
No //nolint was used to silence any of these findings.

docker build --no-cache . passes clean: 0 lint issues, all tests
pass with -race, binary compiles.

internal/service/service.go

@@ -880,23 +880,23 @@ func parseUserModeString(
 	ops := make([]userModeOp, 0, len(modeStr)-1)
 	adding := true
 
-	for _, ch := range modeStr {
-		switch ch {
+	for _, modeChar := range modeStr {
+		switch modeChar {
 		case '+':
 			adding = true
 		case '-':
 			adding = false
 		default:
-			if !isKnownUserModeChar(ch) {
+			if !isKnownUserModeChar(modeChar) {
 				return nil, unknownFlag
 			}
 
-			if ch == 'o' && adding {
+			if modeChar == 'o' && adding {
 				return nil, unknownFlag
 			}
 
 			ops = append(ops, userModeOp{
-				char: ch, adding: adding,
+				char: modeChar, adding: adding,
 			})
 		}
 	}
@@ -910,8 +910,8 @@ func parseUserModeString(
 
 // isKnownUserModeChar reports whether the character is a
 // recognized user mode letter.
-func isKnownUserModeChar(ch rune) bool {
-	switch ch {
+func isKnownUserModeChar(modeChar rune) bool {
+	switch modeChar {
 	case 'w', 'o':
 		return true
 	default: