chore: update golangci-lint to v2.12.2 with canonical config

Replace .golangci.yml with the canonical v2-schema config
(default: all minus six disabled linters, lll 88, tests included)
and bump every golangci-lint pin to v2.12.2:

- Dockerfile: golangci/golangci-lint:v2.12.2-alpine (hash-pinned)
- script/bootstrap: GOLANGCI_LINT_VERSION 2.12.2 with new
  linux-amd64/arm64 release-archive sha256 pins

Fix all 747 findings the stricter config surfaces, with no behavior
changes: t.Parallel() throughout the test suite, static sentinel
errors and errors.Is comparisons, checked error returns, context
propagation (contextcheck/noctx), 88-column wrapping, extracted
constants and helpers for goconst/dupl/funlen/cyclop, exhaustive
switch cases replicating existing defaults, and white-box test files
renamed to *_internal_test.go for testpackage. Three
nolint:tagliatelle directives preserve the existing snake_case JSON
wire and on-disk metadata formats.

internal/imgcache/service.go

@@ -18,7 +18,8 @@ import (
 	"sneak.berlin/go/pixa/internal/signature"
 )
 
-// Service implements the ImageCache interface, orchestrating cache, fetcher, and processor.
+// Service implements the ImageCache interface, orchestrating cache,
+// fetcher, and processor.
 type Service struct {
 	cache           *Cache
 	fetcher         httpfetcher.Fetcher
@@ -46,14 +47,21 @@ type ServiceConfig struct {
 	Logger *slog.Logger
 }
 
+// Static errors for service construction and unimplemented operations.
+var (
+	errCacheRequired       = errors.New("cache is required")
+	errSigningKeyRequired  = errors.New("signing key is required")
+	errPurgeNotImplemented = errors.New("purge not implemented")
+)
+
 // NewService creates a new image service.
 func NewService(cfg *ServiceConfig) (*Service, error) {
 	if cfg.Cache == nil {
-		return nil, errors.New("cache is required")
+		return nil, errCacheRequired
 	}
 
 	if cfg.SigningKey == "" {
-		return nil, errors.New("signing key is required")
+		return nil, errSigningKeyRequired
 	}
 
 	// Resolve fetcher config for defaults
@@ -83,11 +91,14 @@ func NewService(cfg *ServiceConfig) (*Service, error) {
 	}
 
 	maxResponseSize := fetcherCfg.MaxResponseSize
+	processor := imageprocessor.New(
+		imageprocessor.Params{MaxInputBytes: maxResponseSize},
+	)
 
 	return &Service{
 		cache:           cfg.Cache,
 		fetcher:         fetcher,
-		processor:       imageprocessor.New(imageprocessor.Params{MaxInputBytes: maxResponseSize}),
+		processor:       processor,
 		signer:          signer,
 		allowlist:       allowlist.New(cfg.Allowlist),
 		log:             log,
@@ -109,6 +120,7 @@ func (s *Service) Get(ctx context.Context, req *ImageRequest) (*ImageResponse, e
 	if err != nil {
 		s.log.Warn("negative cache check failed", "error", err)
 	}
+
 	if negHit {
 		s.log.Debug("negative cache hit",
 			"host", req.SourceHost,
@@ -145,6 +157,7 @@ func (s *Service) Get(ctx context.Context, req *ImageRequest) (*ImageResponse, e
 
 	// Cache miss - check if we have source content cached
 	cacheKey := CacheKey(req)
+
 	s.cache.IncrementStats(ctx, false, 0)
 
 	response, err := s.processFromSourceOrFetch(ctx, req, cacheKey)
@@ -157,6 +170,57 @@ func (s *Service) Get(ctx context.Context, req *ImageRequest) (*ImageResponse, e
 	return response, nil
 }
 
+// Warm pre-fetches and caches an image without returning it.
+func (s *Service) Warm(ctx context.Context, req *ImageRequest) error {
+	_, err := s.Get(ctx, req)
+
+	return err
+}
+
+// Purge removes a cached image. Purging is not implemented yet.
+func (s *Service) Purge(_ context.Context, _ *ImageRequest) error {
+	return errPurgeNotImplemented
+}
+
+// Stats returns cache statistics.
+func (s *Service) Stats(ctx context.Context) (*CacheStats, error) {
+	return s.cache.Stats(ctx)
+}
+
+// ValidateRequest validates the request signature if required.
+func (s *Service) ValidateRequest(req *ImageRequest) error {
+	// Check if host is allowed (no signature required)
+	sourceURL := req.SourceURL()
+
+	parsedURL, err := url.Parse(sourceURL)
+	if err != nil {
+		return fmt.Errorf("invalid source URL: %w", err)
+	}
+
+	if s.allowlist.IsAllowed(parsedURL) {
+		return nil
+	}
+
+	// Signature required for non-allowed hosts
+	return s.signer.Verify(signatureRequest(req))
+}
+
+// GenerateSignedURL generates a signed URL for the given request.
+func (s *Service) GenerateSignedURL(
+	baseURL string,
+	req *ImageRequest,
+	ttl time.Duration,
+) (string, error) {
+	sigReq := signatureRequest(req)
+	path, sig, exp := s.signer.GenerateSignedURL(sigReq, ttl)
+
+	// Propagate the generated signature and expiration back onto the request.
+	req.Expires = sigReq.Expires
+	req.Signature = sigReq.Signature
+
+	return fmt.Sprintf("%s%s?sig=%s&exp=%d", baseURL, path, sig, exp), nil
+}
+
 // loadCachedSource attempts to load source content from cache, returning nil
 // if the cached data is unavailable or exceeds maxResponseSize.
 func (s *Service) loadCachedSource(contentHash ContentHash) []byte {
@@ -191,7 +255,8 @@ func (s *Service) loadCachedSource(contentHash ContentHash) []byte {
 	return data
 }
 
-// processFromSourceOrFetch processes an image, using cached source content if available.
+// processFromSourceOrFetch processes an image, using cached source content
+// if available.
 func (s *Service) processFromSourceOrFetch(
 	ctx context.Context,
 	req *ImageRequest,
@@ -203,8 +268,10 @@ func (s *Service) processFromSourceOrFetch(
 		s.log.Warn("source lookup failed", "error", err)
 	}
 
-	var sourceData []byte
-	var fetchBytes int64
+	var (
+		sourceData []byte
+		fetchBytes int64
+	)
 
 	if contentHash != "" {
 		s.log.Debug("using cached source", "hash", contentHash)
@@ -258,6 +325,7 @@ func (s *Service) fetchAndProcess(
 
 	// Calculate download bitrate
 	fetchBytes := int64(len(sourceData))
+
 	var downloadRate string
 
 	if fetchResult.FetchDurationMs > 0 {
@@ -280,7 +348,8 @@ func (s *Service) fetchAndProcess(
 	)
 
 	// Validate magic bytes match content type
-	if err := magic.ValidateMagicBytes(sourceData, fetchResult.ContentType); err != nil {
+	err = magic.ValidateMagicBytes(sourceData, fetchResult.ContentType)
+	if err != nil {
 		return nil, fmt.Errorf("content validation failed: %w", err)
 	}
 
@@ -332,7 +401,8 @@ func (s *Service) processAndStore(
 
 	var sizePercent float64
 	if fetchBytes > 0 {
-		sizePercent = float64(outputSize) / float64(fetchBytes) * 100.0 //nolint:mnd // percentage calculation
+		//nolint:mnd // percentage calculation
+		sizePercent = float64(outputSize) / float64(fetchBytes) * 100.0
 	}
 
 	s.log.Info("image converted",
@@ -342,8 +412,10 @@ func (s *Service) processAndStore(
 		"dst_format", req.Format,
 		"src_bytes", fetchBytes,
 		"dst_bytes", outputSize,
-		"src_dimensions", fmt.Sprintf("%dx%d", processResult.InputWidth, processResult.InputHeight),
-		"dst_dimensions", fmt.Sprintf("%dx%d", processResult.Width, processResult.Height),
+		"src_dimensions", fmt.Sprintf("%dx%d",
+			processResult.InputWidth, processResult.InputHeight),
+		"dst_dimensions", fmt.Sprintf("%dx%d",
+			processResult.Width, processResult.Height),
 		"size_ratio", fmt.Sprintf("%.1f%%", sizePercent),
 		"convert_ms", processDuration.Milliseconds(),
 		"quality", req.Quality,
@@ -351,7 +423,10 @@ func (s *Service) processAndStore(
 	)
 
 	// Store variant to cache
-	if err := s.cache.StoreVariant(cacheKey, bytes.NewReader(processedData), processResult.ContentType); err != nil {
+	err = s.cache.StoreVariant(
+		cacheKey, bytes.NewReader(processedData), processResult.ContentType,
+	)
+	if err != nil {
 		s.log.Warn("failed to store variant", "error", err)
 		// Continue even if caching fails
 	}
@@ -365,58 +440,6 @@ func (s *Service) processAndStore(
 	}, nil
 }
 
-// Warm pre-fetches and caches an image without returning it.
-func (s *Service) Warm(ctx context.Context, req *ImageRequest) error {
-	_, err := s.Get(ctx, req)
-
-	return err
-}
-
-// Purge removes a cached image.
-func (s *Service) Purge(_ context.Context, _ *ImageRequest) error {
-	// TODO: Implement purge
-	return errors.New("purge not implemented")
-}
-
-// Stats returns cache statistics.
-func (s *Service) Stats(ctx context.Context) (*CacheStats, error) {
-	return s.cache.Stats(ctx)
-}
-
-// ValidateRequest validates the request signature if required.
-func (s *Service) ValidateRequest(req *ImageRequest) error {
-	// Check if host is allowed (no signature required)
-	sourceURL := req.SourceURL()
-
-	parsedURL, err := url.Parse(sourceURL)
-	if err != nil {
-		return fmt.Errorf("invalid source URL: %w", err)
-	}
-
-	if s.allowlist.IsAllowed(parsedURL) {
-		return nil
-	}
-
-	// Signature required for non-allowed hosts
-	return s.signer.Verify(signatureRequest(req))
-}
-
-// GenerateSignedURL generates a signed URL for the given request.
-func (s *Service) GenerateSignedURL(
-	baseURL string,
-	req *ImageRequest,
-	ttl time.Duration,
-) (string, error) {
-	sigReq := signatureRequest(req)
-	path, sig, exp := s.signer.GenerateSignedURL(sigReq, ttl)
-
-	// Propagate the generated signature and expiration back onto the request.
-	req.Expires = sigReq.Expires
-	req.Signature = sigReq.Signature
-
-	return fmt.Sprintf("%s%s?sig=%s&exp=%d", baseURL, path, sig, exp), nil
-}
-
 // signatureRequest projects an ImageRequest onto the standalone
 // signature.Request type used by the signature package. This keeps the
 // import edge one-way: imgcache depends on signature, never the reverse.