chore: update golangci-lint to v2.12.2 with canonical config

Replace .golangci.yml with the canonical v2-schema config
(default: all minus six disabled linters, lll 88, tests included)
and bump every golangci-lint pin to v2.12.2:

- Dockerfile: golangci/golangci-lint:v2.12.2-alpine (hash-pinned)
- script/bootstrap: GOLANGCI_LINT_VERSION 2.12.2 with new
  linux-amd64/arm64 release-archive sha256 pins

Fix all 747 findings the stricter config surfaces, with no behavior
changes: t.Parallel() throughout the test suite, static sentinel
errors and errors.Is comparisons, checked error returns, context
propagation (contextcheck/noctx), 88-column wrapping, extracted
constants and helpers for goconst/dupl/funlen/cyclop, exhaustive
switch cases replicating existing defaults, and white-box test files
renamed to *_internal_test.go for testpackage. Three
nolint:tagliatelle directives preserve the existing snake_case JSON
wire and on-disk metadata formats.

internal/session/session_cookie_attributes_test.go

@@ -1,9 +1,11 @@
-package session
+package session_test
 
 import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
+
+	"sneak.berlin/go/pixa/internal/session"
 )
 
 // TestSessionCookieAttributesAlwaysSecure verifies that every cookie
@@ -16,7 +18,9 @@ import (
 // This covers both cookie-writing paths: CreateSession (the login
 // set-cookie path) and ClearSession (the logout delete-cookie path).
 func TestSessionCookieAttributesAlwaysSecure(t *testing.T) {
-	mgr, err := NewManager("test-signing-key-12345")
+	t.Parallel()
+
+	mgr, err := session.NewManager("test-signing-key-12345")
 	if err != nil {
 		t.Fatalf("NewManager() error = %v", err)
 	}
@@ -29,7 +33,9 @@ func TestSessionCookieAttributesAlwaysSecure(t *testing.T) {
 			name: "CreateSession",
 			setCookie: func(t *testing.T, w http.ResponseWriter) {
 				t.Helper()
-				if err := mgr.CreateSession(w); err != nil {
+
+				err := mgr.CreateSession(w)
+				if err != nil {
 					t.Fatalf("CreateSession() error = %v", err)
 				}
 			},
@@ -45,12 +51,15 @@ func TestSessionCookieAttributesAlwaysSecure(t *testing.T) {
 
 	for _, writePath := range writePaths {
 		t.Run(writePath.name, func(t *testing.T) {
+			t.Parallel()
+
 			w := httptest.NewRecorder()
 			writePath.setCookie(t, w)
 
 			var sessionCookie *http.Cookie
+
 			for _, c := range w.Result().Cookies() {
-				if c.Name == CookieName {
+				if c.Name == session.CookieName {
 					sessionCookie = c
 
 					break
@@ -58,7 +67,7 @@ func TestSessionCookieAttributesAlwaysSecure(t *testing.T) {
 			}
 
 			if sessionCookie == nil {
-				t.Fatalf("no cookie named %q was set", CookieName)
+				t.Fatalf("no cookie named %q was set", session.CookieName)
 			}
 
 			t.Logf("cookie attributes: HttpOnly=%v Secure=%v SameSite=%v",