lint: adopt org-standard .golangci.yml and golangci-lint v2.12.2 (closes #14)

backend/.golangci.yml declared version: "2" on line 1 but used the
golangci-lint v1 schema below it: a top-level linters-settings key and
an issues.exclude-use-default key that does not exist in v2. Under v2
that config does not validate, so every threshold in it was inert --
lll fell back to its 120-column default rather than the intended 88,
and funlen, cyclop and dupl were not applied at all. The `0 issues.`
result the repo has been relying on was therefore meaningless.

Replace it with the org-standard file verbatim (sha256
021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb) and
repoint the golangci-lint pin in Dockerfile.backend from v2.7.2 to the
org-standard v2.12.2.

Run `golangci-lint config verify` as the first step of the backend
lint target so this class of silent breakage fails the build in future
instead of degrading to default thresholds. It now runs everywhere
`make check` runs, including the pre-commit hook and the Docker build.

With the config actually loading, lll reports server.go:65 at 93
columns. Fix it, plus the two other over-long lines called out on the
issue (server.go:97 at 81 and reportbuf.go:166 at 88) which are inside
the 88-column lint limit but over the 77-column hard wrap in the Go
styleguide. All three were long //nolint justifications on the code
line; move the justification into a preceding comment block and leave
a short directive behind. No suppression is added or widened, and
.golangci.yml is not touched after the copy.

Verified: `cd backend && make check` reports `0 issues.`, root
`make check` passes, and `make docker` builds green against the pinned
v2.12.2.

TODO.md

@@ -10,23 +10,29 @@
 
 # Status
 
-pre-1.0. No git tags. Backend work in flight on feat/reportbuf-storage (dirty:
-src/main.js). Frontend is functional; backend is new and unmerged.
+pre-1.0. No git tags. `feat/reportbuf-storage` is merged; the backend, the CI
+workflow, and the backend repo standard files are all on `main`. Frontend and
+backend are both functional. Working toward the 1.0.0 milestone by closing the
+remaining repo-compliance issues on the tracker.
 
 # Next Step
 
-Land feat/reportbuf-storage: finish the in-progress src/main.js change, get make
-check green, and merge the branch to main. The branch adds the backend (buffered
-zstd-compressed report storage), the CI workflow, and backend repo standard
-files, so merging it also closes most compliance gaps.
+Compliance top-up as one small commit: add `.editorconfig` and add the `hooks`
+target to the root Makefile.
 
 # Completed Steps
 
+- 2026-08-09: adopted the org-standard `backend/.golangci.yml` verbatim and
+  bumped the pinned golangci-lint to v2.12.2; the previous config declared
+  `version: "2"` but used v1 schema keys, so every threshold in it was inert and
+  its green result was meaningless. `make lint` now runs
+  `golangci-lint config verify` first so an invalid config fails the build
+  instead of silently falling back to defaults
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
   shims, README Entrypoints section
 - 2026-02-27: backend with buffered zstd-compressed report storage; CI workflow
   and backend repo standard files; backend Dockerfile fixed (Go 1.25,
-  golangci-lint) and moved to repo root (feat/reportbuf-storage, unmerged)
+  golangci-lint) and moved to repo root (feat/reportbuf-storage)
 - 2026-02-26: host row layout redesigned with CSS grid; overflow and spacing
   fixes; nginx config extracted; port hardcoded to 8080
 - 2026-02-26: debug log panel, median stats, recovery probe, Docker build fix,
@@ -39,9 +45,7 @@ files, so merging it also closes most compliance gaps.
 
 # Future Steps
 
-- Compliance top-up as one small commit: add .editorconfig and add the hooks
-  target to the Makefile
-- After merge, confirm .gitea/workflows/check.yml is on main and CI is green
-  (main always green policy)
+- Confirm `.gitea/workflows/check.yml` is on `main` and CI is green (main always
+  green policy)
 - Decide what to do with untracked resume.sh: commit it, gitignore it, or delete
   it