chore: update golangci-lint to v2.12.2 with canonical config

Replace .golangci.yml with the canonical v2-schema config
(default: all minus six disabled linters, lll 88, tests included)
and bump every golangci-lint pin to v2.12.2:

- Dockerfile: golangci/golangci-lint:v2.12.2-alpine (hash-pinned)
- script/bootstrap: GOLANGCI_LINT_VERSION 2.12.2 with new
  linux-amd64/arm64 release-archive sha256 pins

Fix all 747 findings the stricter config surfaces, with no behavior
changes: t.Parallel() throughout the test suite, static sentinel
errors and errors.Is comparisons, checked error returns, context
propagation (contextcheck/noctx), 88-column wrapping, extracted
constants and helpers for goconst/dupl/funlen/cyclop, exhaustive
switch cases replicating existing defaults, and white-box test files
renamed to *_internal_test.go for testpackage. Three
nolint:tagliatelle directives preserve the existing snake_case JSON
wire and on-disk metadata formats.

internal/encurl/encurl.go

@@ -48,7 +48,8 @@ type Generator struct {
 	key [seal.KeySize]byte
 }
 
-// NewGenerator creates an encrypted URL generator with a key derived from the signing key.
+// NewGenerator creates an encrypted URL generator with a key derived
+// from the signing key.
 func NewGenerator(signingKey string) (*Generator, error) {
 	key, err := seal.DeriveKey([]byte(signingKey), urlKeySalt)
 	if err != nil {
@@ -77,7 +78,8 @@ func (g *Generator) Parse(token string) (*Payload, error) {
 	// Decrypt
 	data, err := seal.Decrypt(g.key, token)
 	if err != nil {
-		if errors.Is(err, seal.ErrDecryptionFailed) || errors.Is(err, seal.ErrInvalidPayload) {
+		if errors.Is(err, seal.ErrDecryptionFailed) ||
+			errors.Is(err, seal.ErrInvalidPayload) {
 			return nil, ErrDecryptFailed
 		}
 
@@ -86,7 +88,9 @@ func (g *Generator) Parse(token string) (*Payload, error) {
 
 	// CBOR decode
 	var p Payload
-	if err := cbor.Unmarshal(data, &p); err != nil {
+
+	err = cbor.Unmarshal(data, &p)
+	if err != nil {
 		return nil, ErrInvalidFormat
 	}
 

internal/encurl/encurl_test.go

@@ -1,22 +1,33 @@
-package encurl
+package encurl_test
 
 import (
+	"errors"
 	"testing"
 	"time"
 
+	"sneak.berlin/go/pixa/internal/encurl"
 	"sneak.berlin/go/pixa/internal/imgcache"
 )
 
+// Shared test fixture strings.
+const (
+	testSourceHost  = "cdn.example.com"
+	testSourcePath  = "/images/photo.jpg"
+	testSourceQuery = "v=2"
+)
+
 func TestGenerator_GenerateAndParse(t *testing.T) {
-	gen, err := NewGenerator("test-signing-key-12345")
+	t.Parallel()
+
+	gen, err := encurl.NewGenerator("test-signing-key-12345")
 	if err != nil {
 		t.Fatalf("NewGenerator() error = %v", err)
 	}
 
-	payload := &Payload{
-		SourceHost:  "cdn.example.com",
-		SourcePath:  "/images/photo.jpg",
-		SourceQuery: "v=2",
+	payload := &encurl.Payload{
+		SourceHost:  testSourceHost,
+		SourcePath:  testSourcePath,
+		SourceQuery: testSourceQuery,
 		Width:       800,
 		Height:      600,
 		Format:      imgcache.FormatWebP,
@@ -43,38 +54,48 @@ func TestGenerator_GenerateAndParse(t *testing.T) {
 	if parsed.SourceHost != payload.SourceHost {
 		t.Errorf("SourceHost = %q, want %q", parsed.SourceHost, payload.SourceHost)
 	}
+
 	if parsed.SourcePath != payload.SourcePath {
 		t.Errorf("SourcePath = %q, want %q", parsed.SourcePath, payload.SourcePath)
 	}
+
 	if parsed.SourceQuery != payload.SourceQuery {
 		t.Errorf("SourceQuery = %q, want %q", parsed.SourceQuery, payload.SourceQuery)
 	}
+
 	if parsed.Width != payload.Width {
 		t.Errorf("Width = %d, want %d", parsed.Width, payload.Width)
 	}
+
 	if parsed.Height != payload.Height {
 		t.Errorf("Height = %d, want %d", parsed.Height, payload.Height)
 	}
+
 	if parsed.Format != payload.Format {
 		t.Errorf("Format = %q, want %q", parsed.Format, payload.Format)
 	}
+
 	if parsed.Quality != payload.Quality {
 		t.Errorf("Quality = %d, want %d", parsed.Quality, payload.Quality)
 	}
+
 	if parsed.FitMode != payload.FitMode {
 		t.Errorf("FitMode = %q, want %q", parsed.FitMode, payload.FitMode)
 	}
+
 	if parsed.ExpiresAt != payload.ExpiresAt {
 		t.Errorf("ExpiresAt = %d, want %d", parsed.ExpiresAt, payload.ExpiresAt)
 	}
 }
 
 func TestGenerator_Parse_Expired(t *testing.T) {
-	gen, _ := NewGenerator("test-signing-key-12345")
+	t.Parallel()
 
-	payload := &Payload{
-		SourceHost: "cdn.example.com",
-		SourcePath: "/images/photo.jpg",
+	gen, _ := encurl.NewGenerator("test-signing-key-12345")
+
+	payload := &encurl.Payload{
+		SourceHost: testSourceHost,
+		SourcePath: testSourcePath,
 		ExpiresAt:  time.Now().Add(-time.Hour).Unix(), // Already expired
 	}
 
@@ -88,13 +109,15 @@ func TestGenerator_Parse_Expired(t *testing.T) {
 		t.Error("Parse() should fail for expired token")
 	}
 
-	if err != ErrExpired {
-		t.Errorf("Parse() error = %v, want %v", err, ErrExpired)
+	if !errors.Is(err, encurl.ErrExpired) {
+		t.Errorf("Parse() error = %v, want %v", err, encurl.ErrExpired)
 	}
 }
 
 func TestGenerator_Parse_InvalidToken(t *testing.T) {
-	gen, _ := NewGenerator("test-signing-key-12345")
+	t.Parallel()
+
+	gen, _ := encurl.NewGenerator("test-signing-key-12345")
 
 	_, err := gen.Parse("not-a-valid-token")
 	if err == nil {
@@ -103,11 +126,13 @@ func TestGenerator_Parse_InvalidToken(t *testing.T) {
 }
 
 func TestGenerator_Parse_TamperedToken(t *testing.T) {
-	gen, _ := NewGenerator("test-signing-key-12345")
+	t.Parallel()
 
-	payload := &Payload{
-		SourceHost: "cdn.example.com",
-		SourcePath: "/images/photo.jpg",
+	gen, _ := encurl.NewGenerator("test-signing-key-12345")
+
+	payload := &encurl.Payload{
+		SourceHost: testSourceHost,
+		SourcePath: testSourcePath,
 		ExpiresAt:  time.Now().Add(time.Hour).Unix(),
 	}
 
@@ -126,12 +151,14 @@ func TestGenerator_Parse_TamperedToken(t *testing.T) {
 }
 
 func TestGenerator_Parse_WrongKey(t *testing.T) {
-	gen1, _ := NewGenerator("signing-key-1")
-	gen2, _ := NewGenerator("signing-key-2")
+	t.Parallel()
 
-	payload := &Payload{
-		SourceHost: "cdn.example.com",
-		SourcePath: "/images/photo.jpg",
+	gen1, _ := encurl.NewGenerator("signing-key-1")
+	gen2, _ := encurl.NewGenerator("signing-key-2")
+
+	payload := &encurl.Payload{
+		SourceHost: testSourceHost,
+		SourcePath: testSourcePath,
 		ExpiresAt:  time.Now().Add(time.Hour).Unix(),
 	}
 
@@ -144,10 +171,12 @@ func TestGenerator_Parse_WrongKey(t *testing.T) {
 }
 
 func TestPayload_ToImageRequest(t *testing.T) {
-	payload := &Payload{
-		SourceHost:  "cdn.example.com",
-		SourcePath:  "/images/photo.jpg",
-		SourceQuery: "v=2",
+	t.Parallel()
+
+	payload := &encurl.Payload{
+		SourceHost:  testSourceHost,
+		SourcePath:  testSourcePath,
+		SourceQuery: testSourceQuery,
 		Width:       800,
 		Height:      600,
 		Format:      imgcache.FormatWebP,
@@ -161,55 +190,68 @@ func TestPayload_ToImageRequest(t *testing.T) {
 	if req.SourceHost != payload.SourceHost {
 		t.Errorf("SourceHost = %q, want %q", req.SourceHost, payload.SourceHost)
 	}
+
 	if req.SourcePath != payload.SourcePath {
 		t.Errorf("SourcePath = %q, want %q", req.SourcePath, payload.SourcePath)
 	}
+
 	if req.SourceQuery != payload.SourceQuery {
 		t.Errorf("SourceQuery = %q, want %q", req.SourceQuery, payload.SourceQuery)
 	}
+
 	if req.Size.Width != payload.Width {
 		t.Errorf("Width = %d, want %d", req.Size.Width, payload.Width)
 	}
+
 	if req.Size.Height != payload.Height {
 		t.Errorf("Height = %d, want %d", req.Size.Height, payload.Height)
 	}
+
 	if req.Format != payload.Format {
 		t.Errorf("Format = %q, want %q", req.Format, payload.Format)
 	}
+
 	if req.Quality != payload.Quality {
 		t.Errorf("Quality = %d, want %d", req.Quality, payload.Quality)
 	}
+
 	if req.FitMode != payload.FitMode {
 		t.Errorf("FitMode = %q, want %q", req.FitMode, payload.FitMode)
 	}
 }
 
 func TestPayload_ToImageRequest_Defaults(t *testing.T) {
+	t.Parallel()
+
 	// Payload with only required fields - should get defaults
-	payload := &Payload{
-		SourceHost: "cdn.example.com",
-		SourcePath: "/images/photo.jpg",
+	payload := &encurl.Payload{
+		SourceHost: testSourceHost,
+		SourcePath: testSourcePath,
 		ExpiresAt:  time.Now().Add(time.Hour).Unix(),
 	}
 
 	req := payload.ToImageRequest()
 
-	if req.Format != DefaultFormat {
-		t.Errorf("Format = %q, want default %q", req.Format, DefaultFormat)
+	if req.Format != encurl.DefaultFormat {
+		t.Errorf("Format = %q, want default %q", req.Format, encurl.DefaultFormat)
 	}
-	if req.Quality != DefaultQuality {
-		t.Errorf("Quality = %d, want default %d", req.Quality, DefaultQuality)
+
+	if req.Quality != encurl.DefaultQuality {
+		t.Errorf("Quality = %d, want default %d", req.Quality, encurl.DefaultQuality)
 	}
-	if req.FitMode != DefaultFitMode {
-		t.Errorf("FitMode = %q, want default %q", req.FitMode, DefaultFitMode)
+
+	if req.FitMode != encurl.DefaultFitMode {
+		t.Errorf("FitMode = %q, want default %q", req.FitMode, encurl.DefaultFitMode)
 	}
 }
 
 func TestFromImageRequest(t *testing.T) {
+	t.Parallel()
+
 	req := &imgcache.ImageRequest{
-		SourceHost:  "cdn.example.com",
-		SourcePath:  "/images/photo.jpg",
-		SourceQuery: "v=2",
+		SourceHost:  testSourceHost,
+		SourcePath:  testSourcePath,
+		SourceQuery: testSourceQuery,
 		Size:        imgcache.Size{Width: 800, Height: 600},
 		Format:      imgcache.FormatWebP,
 		Quality:     90,
@@ -217,52 +259,62 @@ func TestFromImageRequest(t *testing.T) {
 	}
 
 	expiresAt := time.Now().Add(time.Hour)
-	payload := FromImageRequest(req, expiresAt)
+	payload := encurl.FromImageRequest(req, expiresAt)
 
 	if payload.SourceHost != req.SourceHost {
 		t.Errorf("SourceHost = %q, want %q", payload.SourceHost, req.SourceHost)
 	}
+
 	if payload.SourcePath != req.SourcePath {
 		t.Errorf("SourcePath = %q, want %q", payload.SourcePath, req.SourcePath)
 	}
+
 	if payload.Width != req.Size.Width {
 		t.Errorf("Width = %d, want %d", payload.Width, req.Size.Width)
 	}
+
 	if payload.ExpiresAt != expiresAt.Unix() {
 		t.Errorf("ExpiresAt = %d, want %d", payload.ExpiresAt, expiresAt.Unix())
 	}
 }
 
 func TestFromImageRequest_OmitsDefaults(t *testing.T) {
-	// Request with default values - payload should omit them for smaller encoding
+	t.Parallel()
+
+	// Request with default values - payload should omit them for
+	// smaller encoding
 	req := &imgcache.ImageRequest{
-		SourceHost: "cdn.example.com",
-		SourcePath: "/images/photo.jpg",
-		Format:     DefaultFormat,
-		Quality:    DefaultQuality,
-		FitMode:    DefaultFitMode,
+		SourceHost: testSourceHost,
+		SourcePath: testSourcePath,
+		Format:     encurl.DefaultFormat,
+		Quality:    encurl.DefaultQuality,
+		FitMode:    encurl.DefaultFitMode,
 	}
 
-	payload := FromImageRequest(req, time.Now().Add(time.Hour))
+	payload := encurl.FromImageRequest(req, time.Now().Add(time.Hour))
 
 	// These should be zero/empty because they match defaults
 	if payload.Format != "" {
 		t.Errorf("Format should be empty for default, got %q", payload.Format)
 	}
+
 	if payload.Quality != 0 {
 		t.Errorf("Quality should be 0 for default, got %d", payload.Quality)
 	}
+
 	if payload.FitMode != "" {
 		t.Errorf("FitMode should be empty for default, got %q", payload.FitMode)
 	}
 }
 
 func TestGenerator_TokenIsURLSafe(t *testing.T) {
-	gen, _ := NewGenerator("test-signing-key-12345")
+	t.Parallel()
 
-	payload := &Payload{
-		SourceHost: "cdn.example.com",
-		SourcePath: "/images/photo.jpg",
+	gen, _ := encurl.NewGenerator("test-signing-key-12345")
+
+	payload := &encurl.Payload{
+		SourceHost: testSourceHost,
+		SourcePath: testSourcePath,
 		ExpiresAt:  time.Now().Add(time.Hour).Unix(),
 	}