chore: update golangci-lint to v2.12.2 with canonical config (#54)

Canonical v2-schema `.golangci.yml`, golangci-lint pins bumped to v2.12.2 in `Dockerfile` and `script/bootstrap`, and the tree brought to `0 issues.` under it.

Three behaviour deltas: `Cache.StoreVariant` takes a context (cancelled requests skip the accounting row, recovered by reconciliation); `MetadataStorage.Store` no longer leaks `.tmp-*.json` on Write/Close/Rename failure (dead-defer bug fix); the `signing_key` too-short error text gained a `value too short:` prefix.

Eviction-loop context cancellation deferred to #102.

internal/handlers/imageenc.go

@@ -15,8 +15,9 @@ import (
 	"sneak.berlin/go/pixa/internal/imgcache"
 )
 
-// HandleImageEnc handles requests to /v1/e/{token}/* for encrypted image URLs.
-// The trailing path (e.g., /img.jpg) is ignored but helps browsers identify the content type.
+// HandleImageEnc handles requests to /v1/e/{token}/* for encrypted
+// image URLs. The trailing path (e.g., /img.jpg) is ignored but helps
+// browsers identify the content type.
 func (s *Handlers) HandleImageEnc() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
@@ -57,17 +58,20 @@ func (s *Handlers) HandleImageEnc() http.HandlerFunc {
 			"format", req.Format,
 		)
 
-		// Fetch and process the image (no signature validation needed - encrypted URL is trusted)
+		// Fetch and process the image (no signature validation
+		// needed - encrypted URL is trusted)
 		resp, err := s.imgSvc.Get(ctx, req)
 		if err != nil {
 			s.handleImageError(w, err)
 
 			return
 		}
+
 		defer func() { _ = resp.Content.Close() }()
 
 		// Set response headers
 		w.Header().Set("Content-Type", resp.ContentType)
+
 		if resp.ContentLength > 0 {
 			w.Header().Set("Content-Length", strconv.FormatInt(resp.ContentLength, 10))
 		}