lint: adopt org-standard .golangci.yml and golangci-lint v2.12.2 (closes #14)

The old backend/.golangci.yml declared version "2" but used v1 schema
keys, so under v2 it never validated and its thresholds were inert: the
linter ran at defaults. Replace it verbatim with the org-standard file,
repin the Dockerfile.backend lint stage to golangci-lint v2.12.2, and
assert the config's sha256 as the first step of the backend lint target
so it cannot silently drift again -- a local hash check, no network.
Fix every finding the standard config surfaces in the Go source: wrap
over-long lines, drop a dead //nolint:wsl, hoist the repeated test IP
literals in middleware_test.go to named constants (goconst), and switch
its request to NewRequestWithContext (noctx). TODO.md updated.

Model: opus-4-8

backend/internal/server/server.go

@@ -62,7 +62,10 @@ func New(
 		OnStart: func(_ context.Context) error {
 			s.startupTime = time.Now().UTC()
 
-			go func() { //nolint:contextcheck // fx OnStart ctx is startup-only; run() creates its own
+			// The fx OnStart context is scoped to startup and is
+			// cancelled once the hook returns; run() derives its
+			// own context instead of inheriting this one.
+			go func() { //nolint:contextcheck // see comment above
 				s.run()
 			}()
 
@@ -94,7 +97,7 @@ func (s *Server) run() {
 }
 
 func (s *Server) serve() int {
-	var ctx context.Context //nolint:wsl // ctx must be declared before multi-assign
+	var ctx context.Context
 
 	ctx, s.cancelFunc = context.WithCancel(
 		context.Background(),