chore: update golangci-lint to v2.12.2 with canonical config (#54)

Canonical v2-schema `.golangci.yml`, golangci-lint pins bumped to v2.12.2 in `Dockerfile` and `script/bootstrap`, and the tree brought to `0 issues.` under it.

Three behaviour deltas: `Cache.StoreVariant` takes a context (cancelled requests skip the accounting row, recovered by reconciliation); `MetadataStorage.Store` no longer leaks `.tmp-*.json` on Write/Close/Rename failure (dead-defer bug fix); the `signing_key` too-short error text gained a `value too short:` prefix.

Eviction-loop context cancellation deferred to #102.

internal/signature/signature.go

@@ -93,31 +93,17 @@ func (s *Signer) Verify(req *Request) error {
 	return nil
 }
 
-// buildSignatureData creates the string to be signed.
-// Format: "host:path:query:width:height:format:expiration"
-// All components are used verbatim (exact match). No normalization,
-// suffix matching, or wildcard expansion is performed.
-func (s *Signer) buildSignatureData(req *Request) string {
-	return fmt.Sprintf("%s:%s:%s:%d:%d:%s:%d",
-		req.SourceHost,
-		req.SourcePath,
-		req.SourceQuery,
-		req.Width,
-		req.Height,
-		req.Format,
-		req.Expires.Unix(),
-	)
-}
-
 // GenerateSignedURL creates a complete URL with signature and expiration.
 // Returns the path portion that should be appended to the base URL.
-func (s *Signer) GenerateSignedURL(req *Request, ttl time.Duration) (path string, sig string, exp int64) {
+func (s *Signer) GenerateSignedURL(
+	req *Request, ttl time.Duration,
+) (string, string, int64) {
 	// Set expiration
 	req.Expires = time.Now().Add(ttl)
-	exp = req.Expires.Unix()
+	exp := req.Expires.Unix()
 
 	// Generate signature
-	sig = s.Sign(req)
+	sig := s.Sign(req)
 	req.Signature = sig
 
 	// Build the size component
@@ -134,6 +120,7 @@ func (s *Signer) GenerateSignedURL(req *Request, ttl time.Duration) (path string
 	// it from the last-slash split. The "?" inside a path segment is
 	// percent-encoded by clients but chi delivers it decoded, which is
 	// exactly what the URL parser expects.
+	var path string
 	if req.SourceQuery != "" {
 		path = fmt.Sprintf("/v1/image/%s%s%%3F%s/%s.%s",
 			req.SourceHost,
@@ -154,12 +141,26 @@ func (s *Signer) GenerateSignedURL(req *Request, ttl time.Duration) (path string
 	return path, sig, exp
 }
 
-// ParseParams extracts signature and expiration from query parameters.
-func ParseParams(sig, expStr string) (parsed string, expires time.Time, err error) {
-	parsed = sig
+// buildSignatureData creates the string to be signed.
+// Format: "host:path:query:width:height:format:expiration"
+// All components are used verbatim (exact match). No normalization,
+// suffix matching, or wildcard expansion is performed.
+func (s *Signer) buildSignatureData(req *Request) string {
+	return fmt.Sprintf("%s:%s:%s:%d:%d:%s:%d",
+		req.SourceHost,
+		req.SourcePath,
+		req.SourceQuery,
+		req.Width,
+		req.Height,
+		req.Format,
+		req.Expires.Unix(),
+	)
+}
 
+// ParseParams extracts signature and expiration from query parameters.
+func ParseParams(sig, expStr string) (string, time.Time, error) {
 	if expStr == "" {
-		return parsed, time.Time{}, nil
+		return sig, time.Time{}, nil
 	}
 
 	expUnix, err := strconv.ParseInt(expStr, 10, 64)
@@ -167,7 +168,5 @@ func ParseParams(sig, expStr string) (parsed string, expires time.Time, err erro
 		return "", time.Time{}, fmt.Errorf("invalid expiration: %w", err)
 	}
 
-	expires = time.Unix(expUnix, 0)
-
-	return parsed, expires, nil
+	return sig, time.Unix(expUnix, 0), nil
 }