chore: update golangci-lint to v2.12.2 with canonical config (#54)

Canonical v2-schema `.golangci.yml`, golangci-lint pins bumped to v2.12.2 in `Dockerfile` and `script/bootstrap`, and the tree brought to `0 issues.` under it.

Three behaviour deltas: `Cache.StoreVariant` takes a context (cancelled requests skip the accounting row, recovered by reconciliation); `MetadataStorage.Store` no longer leaks `.tmp-*.json` on Write/Close/Rename failure (dead-defer bug fix); the `signing_key` too-short error text gained a `value too short:` prefix.

Eviction-loop context cancellation deferred to #102.

internal/config/config_internal_test.go

@@ -0,0 +1,98 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"git.eeqj.de/sneak/smartconfig"
+)
+
+// writeTestConfig writes yamlContent to a temp config file and returns
+// the file path.
+func writeTestConfig(t *testing.T, yamlContent string) string {
+	t.Helper()
+
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, "config.yml")
+
+	err := os.WriteFile(configPath, []byte(yamlContent), 0o600)
+	if err != nil {
+		t.Fatalf("failed to write test config: %v", err)
+	}
+
+	return configPath
+}
+
+// checkAllowlistHosts loads the config at configPath and asserts that
+// getStringSlice returns the three expected hosts.
+func checkAllowlistHosts(t *testing.T, configPath string) {
+	t.Helper()
+
+	sc, err := loadTestConfig(configPath)
+	if err != nil {
+		t.Fatalf("failed to load config: %v", err)
+	}
+
+	hosts := getStringSlice(sc)
+
+	if len(hosts) != 3 {
+		t.Errorf("expected 3 hosts, got %d: %v", len(hosts), hosts)
+	}
+
+	expected := []string{"static.sneak.cloud", "sneak.berlin", testHostS3}
+	for i, want := range expected {
+		if i >= len(hosts) {
+			t.Errorf("missing host at index %d: want %q", i, want)
+
+			continue
+		}
+
+		if hosts[i] != want {
+			t.Errorf("host[%d] = %q, want %q", i, hosts[i], want)
+		}
+	}
+}
+
+func TestGetStringSlice_YAMLList(t *testing.T) {
+	t.Parallel()
+
+	yamlContent := `
+allowlist_hosts:
+  - static.sneak.cloud
+  - sneak.berlin
+  - s3.sneak.cloud
+`
+
+	checkAllowlistHosts(t, writeTestConfig(t, yamlContent))
+}
+
+func TestGetStringSlice_CommaSeparated(t *testing.T) {
+	t.Parallel()
+
+	// Backwards compatibility with comma-separated string values.
+	yamlContent := `allowlist_hosts: "static.sneak.cloud, sneak.berlin, s3.sneak.cloud"`
+
+	checkAllowlistHosts(t, writeTestConfig(t, yamlContent))
+}
+
+func TestGetStringSlice_Empty(t *testing.T) {
+	t.Parallel()
+
+	configPath := writeTestConfig(t, `port: 8080`)
+
+	sc, err := loadTestConfig(configPath)
+	if err != nil {
+		t.Fatalf("failed to load config: %v", err)
+	}
+
+	hosts := getStringSlice(sc)
+	if len(hosts) != 0 {
+		t.Errorf("expected nil or empty slice, got %v", hosts)
+	}
+}
+
+// loadTestConfig is a helper to load a config file for testing.
+func loadTestConfig(path string) (*smartconfig.Config, error) {
+	return smartconfig.NewFromConfigPath(path)
+}