chore: update golangci-lint to v2.12.2 with canonical config

Replace .golangci.yml with the canonical v2-schema config
(default: all minus six disabled linters, lll 88, tests included)
and bump every golangci-lint pin to v2.12.2:

- Dockerfile: golangci/golangci-lint:v2.12.2-alpine (hash-pinned)
- script/bootstrap: GOLANGCI_LINT_VERSION 2.12.2 with new
  linux-amd64/arm64 release-archive sha256 pins

Fix all 747 findings the stricter config surfaces, with no behavior
changes: t.Parallel() throughout the test suite, static sentinel
errors and errors.Is comparisons, checked error returns, context
propagation (contextcheck/noctx), 88-column wrapping, extracted
constants and helpers for goconst/dupl/funlen/cyclop, exhaustive
switch cases replicating existing defaults, and white-box test files
renamed to *_internal_test.go for testpackage. Three
nolint:tagliatelle directives preserve the existing snake_case JSON
wire and on-disk metadata formats.

internal/database/database.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"database/sql"
 	"embed"
+	"errors"
 	"fmt"
 	"log/slog"
 	"path/filepath"
@@ -29,10 +30,15 @@ const bootstrapVersion = 0
 // Params defines dependencies for Database.
 type Params struct {
 	fx.In
+
 	Logger *logger.Logger
 	Config *config.Config
 }
 
+// errInvalidMigrationFilename is returned when a migration filename does
+// not match the "<version>[_<description>].sql" pattern.
+var errInvalidMigrationFilename = errors.New("invalid migration filename")
+
 // Database wraps the SQL database connection.
 type Database struct {
 	db     *sql.DB
@@ -48,33 +54,31 @@ type Database struct {
 func ParseMigrationVersion(filename string) (int, error) {
 	name := strings.TrimSuffix(filename, filepath.Ext(filename))
 	if name == "" {
-		return 0, fmt.Errorf("invalid migration filename %q: empty name", filename)
+		return 0, fmt.Errorf("%w %q: empty name", errInvalidMigrationFilename, filename)
 	}
 
 	// Split on underscore to separate version from description.
 	// If there's no underscore, the entire stem is the version.
-	versionStr := name
-	if idx := strings.IndexByte(name, '_'); idx >= 0 {
-		versionStr = name[:idx]
-	}
-
+	versionStr, _, _ := strings.Cut(name, "_")
 	if versionStr == "" {
-		return 0, fmt.Errorf("invalid migration filename %q: empty version prefix", filename)
+		return 0, fmt.Errorf(
+			"%w %q: empty version prefix", errInvalidMigrationFilename, filename,
+		)
 	}
 
 	// Validate the version is purely numeric.
 	for _, ch := range versionStr {
 		if ch < '0' || ch > '9' {
 			return 0, fmt.Errorf(
-				"invalid migration filename %q: version %q contains non-numeric character %q",
-				filename, versionStr, string(ch),
+				"%w %q: version %q contains non-numeric character %q",
+				errInvalidMigrationFilename, filename, versionStr, string(ch),
 			)
 		}
 	}
 
 	version, err := strconv.Atoi(versionStr)
 	if err != nil {
-		return 0, fmt.Errorf("invalid migration filename %q: %w", filename, err)
+		return 0, fmt.Errorf("%w %q: %w", errInvalidMigrationFilename, filename, err)
 	}
 
 	return version, nil
@@ -97,6 +101,7 @@ func New(lc fx.Lifecycle, params Params) (*Database, error) {
 		},
 		OnStop: func(_ context.Context) error {
 			s.log.Info("Database OnStop Hook")
+
 			if s.db != nil {
 				return s.db.Close()
 			}
@@ -108,30 +113,6 @@ func New(lc fx.Lifecycle, params Params) (*Database, error) {
 	return s, nil
 }
 
-func (s *Database) connect(ctx context.Context) error {
-	dbURL := s.config.DBURL
-
-	s.log.Info("connecting to database", "url", dbURL)
-
-	db, err := sql.Open("sqlite", dbURL)
-	if err != nil {
-		s.log.Error("failed to open database", "error", err)
-
-		return err
-	}
-
-	if err := db.PingContext(ctx); err != nil {
-		s.log.Error("failed to ping database", "error", err)
-
-		return err
-	}
-
-	s.db = db
-	s.log.Info("database connected")
-
-	return ApplyMigrations(ctx, s.db, s.log)
-}
-
 // collectMigrations reads the embedded schema directory and returns
 // migration filenames sorted lexicographically.
 func collectMigrations() ([]string, error) {
@@ -191,7 +172,8 @@ func bootstrapMigrationsTable(ctx context.Context, db *sql.DB, log *slog.Logger)
 // This is exported so tests can apply the real schema without the full fx
 // lifecycle.
 func ApplyMigrations(ctx context.Context, db *sql.DB, log *slog.Logger) error {
-	if err := bootstrapMigrationsTable(ctx, db, log); err != nil {
+	err := bootstrapMigrationsTable(ctx, db, log)
+	if err != nil {
 		return err
 	}
 
@@ -261,3 +243,28 @@ func ApplyMigrations(ctx context.Context, db *sql.DB, log *slog.Logger) error {
 func (s *Database) DB() *sql.DB {
 	return s.db
 }
+
+func (s *Database) connect(ctx context.Context) error {
+	dbURL := s.config.DBURL
+
+	s.log.Info("connecting to database", "url", dbURL)
+
+	db, err := sql.Open("sqlite", dbURL)
+	if err != nil {
+		s.log.Error("failed to open database", "error", err)
+
+		return err
+	}
+
+	err = db.PingContext(ctx)
+	if err != nil {
+		s.log.Error("failed to ping database", "error", err)
+
+		return err
+	}
+
+	s.db = db
+	s.log.Info("database connected")
+
+	return ApplyMigrations(ctx, s.db, s.log)
+}