next -> main (1.0.0 milestone) (#105)

Accumulating milestone branch. One squashed commit per closed issue; `next` is kept green and mergeable to `main` at any time without notice.

Landed so far:

- `chore: update golangci-lint to v2.12.2 with canonical config` (#54) — canonical v2-schema `.golangci.yml`, pins bumped in `Dockerfile` and `script/bootstrap`, tree at `0 issues.`. Three behaviour deltas are recorded in that PR's body: `Cache.StoreVariant` takes a context, `MetadataStorage.Store` no longer leaks temp files on failure, and the `signing_key` too-short error text gained a `value too short:` prefix.

Sequencing for the milestone is tracked in #103.

Reviewed-on: #105
Co-authored-by: clawbot <clawbot@noreply.example.org>

internal/handlers/imageenc.go

@@ -15,8 +15,9 @@ import (
 	"sneak.berlin/go/pixa/internal/imgcache"
 )
 
-// HandleImageEnc handles requests to /v1/e/{token}/* for encrypted image URLs.
-// The trailing path (e.g., /img.jpg) is ignored but helps browsers identify the content type.
+// HandleImageEnc handles requests to /v1/e/{token}/* for encrypted
+// image URLs. The trailing path (e.g., /img.jpg) is ignored but helps
+// browsers identify the content type.
 func (s *Handlers) HandleImageEnc() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
@@ -57,17 +58,20 @@ func (s *Handlers) HandleImageEnc() http.HandlerFunc {
 			"format", req.Format,
 		)
 
-		// Fetch and process the image (no signature validation needed - encrypted URL is trusted)
+		// Fetch and process the image (no signature validation
+		// needed - encrypted URL is trusted)
 		resp, err := s.imgSvc.Get(ctx, req)
 		if err != nil {
 			s.handleImageError(w, err)
 
 			return
 		}
+
 		defer func() { _ = resp.Content.Close() }()
 
 		// Set response headers
 		w.Header().Set("Content-Type", resp.ContentType)
+
 		if resp.ContentLength > 0 {
 			w.Header().Set("Content-Length", strconv.FormatInt(resp.ContentLength, 10))
 		}