chore: update golangci-lint to v2.12.2 with canonical config (#54)

Canonical v2-schema `.golangci.yml`, golangci-lint pins bumped to v2.12.2 in `Dockerfile` and `script/bootstrap`, and the tree brought to `0 issues.` under it.

Three behaviour deltas: `Cache.StoreVariant` takes a context (cancelled requests skip the accounting row, recovered by reconciliation); `MetadataStorage.Store` no longer leaks `.tmp-*.json` on Write/Close/Rename failure (dead-defer bug fix); the `signing_key` too-short error text gained a `value too short:` prefix.

Eviction-loop context cancellation deferred to #102.

internal/handlers/handlers.go

@@ -22,6 +22,7 @@ import (
 // Params defines dependencies for Handlers.
 type Params struct {
 	fx.In
+
 	Logger      *logger.Logger
 	Healthcheck *healthcheck.Healthcheck
 	Database    *database.Database
@@ -50,6 +51,14 @@ func New(lc fx.Lifecycle, params Params) (*Handlers, error) {
 	}
 
 	lc.Append(fx.Hook{
+		// The eviction goroutine must outlive OnStart, so it cannot
+		// inherit this hook's context. It makes its own instead, which
+		// leaves it uncancellable: an in-flight pass runs to completion
+		// during OnStop regardless of the shutdown deadline. Making the
+		// loop cancellable changes shutdown semantics and is tracked
+		// separately in issue #102, rather than being folded into the
+		// lint-conformance change that surfaced it.
+		//nolint:contextcheck // see issue #102
 		OnStart: func(_ context.Context) error {
 			return s.initImageService()
 		},
@@ -90,6 +99,7 @@ func (s *Handlers) initImageService() error {
 	// Create the fetcher config
 	fetcherCfg := httpfetcher.DefaultConfig()
 	fetcherCfg.AllowHTTP = s.config.AllowHTTP
+
 	if s.config.UpstreamConnectionsPerHost > 0 {
 		fetcherCfg.MaxConnectionsPerHost = s.config.UpstreamConnectionsPerHost
 	}
@@ -115,6 +125,7 @@ func (s *Handlers) initImageService() error {
 	if err != nil {
 		return err
 	}
+
 	s.sessMgr = sessMgr
 
 	// Initialize encrypted URL generator
@@ -122,6 +133,7 @@ func (s *Handlers) initImageService() error {
 	if err != nil {
 		return err
 	}
+
 	s.encGen = encGen
 
 	s.log.Info("session manager and URL generator initialized")
@@ -129,9 +141,10 @@ func (s *Handlers) initImageService() error {
 	return nil
 }
 
-func (s *Handlers) respondJSON(w http.ResponseWriter, data interface{}, status int) {
+func (s *Handlers) respondJSON(w http.ResponseWriter, data any, status int) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(status)
+
 	if data != nil {
 		err := json.NewEncoder(w).Encode(data)
 		if err != nil {
@@ -141,7 +154,7 @@ func (s *Handlers) respondJSON(w http.ResponseWriter, data interface{}, status i
 }
 
 func (s *Handlers) respondError(w http.ResponseWriter, message string, status int) {
-	s.respondJSON(w, map[string]interface{}{
+	s.respondJSON(w, map[string]any{
 		"error":     message,
 		"status":    status,
 		"timestamp": time.Now().UTC().Format(time.RFC3339),