chore: update golangci-lint to v2.12.2 with canonical config

Replace .golangci.yml with the canonical v2-schema config
(default: all minus six disabled linters, lll 88, tests included)
and bump every golangci-lint pin to v2.12.2:

- Dockerfile: golangci/golangci-lint:v2.12.2-alpine (hash-pinned)
- script/bootstrap: GOLANGCI_LINT_VERSION 2.12.2 with new
  linux-amd64/arm64 release-archive sha256 pins

Fix all 747 findings the stricter config surfaces, with no behavior
changes: t.Parallel() throughout the test suite, static sentinel
errors and errors.Is comparisons, checked error returns, context
propagation (contextcheck/noctx), 88-column wrapping, extracted
constants and helpers for goconst/dupl/funlen/cyclop, exhaustive
switch cases replicating existing defaults, and white-box test files
renamed to *_internal_test.go for testpackage. Three
nolint:tagliatelle directives preserve the existing snake_case JSON
wire and on-disk metadata formats.

internal/signature/signature.go

@@ -93,31 +93,17 @@ func (s *Signer) Verify(req *Request) error {
 	return nil
 }
 
-// buildSignatureData creates the string to be signed.
-// Format: "host:path:query:width:height:format:expiration"
-// All components are used verbatim (exact match). No normalization,
-// suffix matching, or wildcard expansion is performed.
-func (s *Signer) buildSignatureData(req *Request) string {
-	return fmt.Sprintf("%s:%s:%s:%d:%d:%s:%d",
-		req.SourceHost,
-		req.SourcePath,
-		req.SourceQuery,
-		req.Width,
-		req.Height,
-		req.Format,
-		req.Expires.Unix(),
-	)
-}
-
 // GenerateSignedURL creates a complete URL with signature and expiration.
 // Returns the path portion that should be appended to the base URL.
-func (s *Signer) GenerateSignedURL(req *Request, ttl time.Duration) (path string, sig string, exp int64) {
+func (s *Signer) GenerateSignedURL(
+	req *Request, ttl time.Duration,
+) (string, string, int64) {
 	// Set expiration
 	req.Expires = time.Now().Add(ttl)
-	exp = req.Expires.Unix()
+	exp := req.Expires.Unix()
 
 	// Generate signature
-	sig = s.Sign(req)
+	sig := s.Sign(req)
 	req.Signature = sig
 
 	// Build the size component
@@ -134,6 +120,7 @@ func (s *Signer) GenerateSignedURL(req *Request, ttl time.Duration) (path string
 	// it from the last-slash split. The "?" inside a path segment is
 	// percent-encoded by clients but chi delivers it decoded, which is
 	// exactly what the URL parser expects.
+	var path string
 	if req.SourceQuery != "" {
 		path = fmt.Sprintf("/v1/image/%s%s%%3F%s/%s.%s",
 			req.SourceHost,
@@ -154,12 +141,26 @@ func (s *Signer) GenerateSignedURL(req *Request, ttl time.Duration) (path string
 	return path, sig, exp
 }
 
-// ParseParams extracts signature and expiration from query parameters.
-func ParseParams(sig, expStr string) (parsed string, expires time.Time, err error) {
-	parsed = sig
+// buildSignatureData creates the string to be signed.
+// Format: "host:path:query:width:height:format:expiration"
+// All components are used verbatim (exact match). No normalization,
+// suffix matching, or wildcard expansion is performed.
+func (s *Signer) buildSignatureData(req *Request) string {
+	return fmt.Sprintf("%s:%s:%s:%d:%d:%s:%d",
+		req.SourceHost,
+		req.SourcePath,
+		req.SourceQuery,
+		req.Width,
+		req.Height,
+		req.Format,
+		req.Expires.Unix(),
+	)
+}
 
+// ParseParams extracts signature and expiration from query parameters.
+func ParseParams(sig, expStr string) (string, time.Time, error) {
 	if expStr == "" {
-		return parsed, time.Time{}, nil
+		return sig, time.Time{}, nil
 	}
 
 	expUnix, err := strconv.ParseInt(expStr, 10, 64)
@@ -167,7 +168,5 @@ func ParseParams(sig, expStr string) (parsed string, expires time.Time, err erro
 		return "", time.Time{}, fmt.Errorf("invalid expiration: %w", err)
 	}
 
-	expires = time.Unix(expUnix, 0)
-
-	return parsed, expires, nil
+	return sig, time.Unix(expUnix, 0), nil
 }