chore: update golangci-lint to v2.12.2 with canonical config (#54)

Canonical v2-schema `.golangci.yml`, golangci-lint pins bumped to v2.12.2 in `Dockerfile` and `script/bootstrap`, and the tree brought to `0 issues.` under it.

Three behaviour deltas: `Cache.StoreVariant` takes a context (cancelled requests skip the accounting row, recovered by reconciliation); `MetadataStorage.Store` no longer leaks `.tmp-*.json` on Write/Close/Rename failure (dead-defer bug fix); the `signing_key` too-short error text gained a `value too short:` prefix.

Eviction-loop context cancellation deferred to #102.

internal/session/session_cookie_attributes_test.go

@@ -1,9 +1,11 @@
-package session
+package session_test
 
 import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
+
+	"sneak.berlin/go/pixa/internal/session"
 )
 
 // TestSessionCookieAttributesAlwaysSecure verifies that every cookie
@@ -16,7 +18,9 @@ import (
 // This covers both cookie-writing paths: CreateSession (the login
 // set-cookie path) and ClearSession (the logout delete-cookie path).
 func TestSessionCookieAttributesAlwaysSecure(t *testing.T) {
-	mgr, err := NewManager("test-signing-key-12345")
+	t.Parallel()
+
+	mgr, err := session.NewManager("test-signing-key-12345")
 	if err != nil {
 		t.Fatalf("NewManager() error = %v", err)
 	}
@@ -29,7 +33,9 @@ func TestSessionCookieAttributesAlwaysSecure(t *testing.T) {
 			name: "CreateSession",
 			setCookie: func(t *testing.T, w http.ResponseWriter) {
 				t.Helper()
-				if err := mgr.CreateSession(w); err != nil {
+
+				err := mgr.CreateSession(w)
+				if err != nil {
 					t.Fatalf("CreateSession() error = %v", err)
 				}
 			},
@@ -45,12 +51,15 @@ func TestSessionCookieAttributesAlwaysSecure(t *testing.T) {
 
 	for _, writePath := range writePaths {
 		t.Run(writePath.name, func(t *testing.T) {
+			t.Parallel()
+
 			w := httptest.NewRecorder()
 			writePath.setCookie(t, w)
 
 			var sessionCookie *http.Cookie
+
 			for _, c := range w.Result().Cookies() {
-				if c.Name == CookieName {
+				if c.Name == session.CookieName {
 					sessionCookie = c
 
 					break
@@ -58,7 +67,7 @@ func TestSessionCookieAttributesAlwaysSecure(t *testing.T) {
 			}
 
 			if sessionCookie == nil {
-				t.Fatalf("no cookie named %q was set", CookieName)
+				t.Fatalf("no cookie named %q was set", session.CookieName)
 			}
 
 			t.Logf("cookie attributes: HttpOnly=%v Secure=%v SameSite=%v",