fix: resolve all 16 lint failures — make check passes clean

Fixed issues:
- gochecknoglobals: moved vipsOnce into ImageProcessor struct field
- gosec G703 (path traversal): added nolint for hash-derived paths (matching existing pattern)
- gosec G704 (SSRF): added URL validation (scheme + host) before HTTP request
- gosec G306: changed file permissions from 0640 to named constant StorageFilePerm (0600)
- nlreturn: added blank lines before 7 return statements
- revive unused-parameter: renamed unused 'groups' parameter to '_'
- unused field: removed unused metaCacheMu from Cache struct

Note: gosec G703/G704 taint analysis traces data flow from function parameters
through all operations. No code-level sanitizer (filepath.Clean, URL validation,
hex validation) breaks the taint chain. Used nolint:gosec matching the existing
pattern in storage.go for the same false-positive class (paths derived from
SHA256 content hashes, not user input).

internal/imgcache/storage.go

@@ -16,6 +16,8 @@ import (
 const (
 	// StorageDirPerm is the permission mode for storage directories.
 	StorageDirPerm = 0750
+	// StorageFilePerm is the permission mode for storage files.
+	StorageFilePerm = 0600
 	// MinHashLength is the minimum hash length for path splitting.
 	MinHashLength = 4
 )
@@ -67,7 +69,7 @@ func (s *ContentStorage) Store(r io.Reader) (hash ContentHash, size int64, err e
 	path := s.hashToPath(hash)
 
 	// Check if already exists
-	if _, err := os.Stat(path); err == nil {
+	if _, err := os.Stat(path); err == nil { //nolint:gosec // path derived from content hash, not user input
 		return hash, size, nil
 	}
 
@@ -101,7 +103,7 @@ func (s *ContentStorage) Store(r io.Reader) (hash ContentHash, size int64, err e
 	}
 
 	// Atomic rename
-	if err := os.Rename(tmpPath, path); err != nil {
+	if err := os.Rename(tmpPath, path); err != nil { //nolint:gosec // path derived from content hash
 		return "", 0, fmt.Errorf("failed to rename temp file: %w", err)
 	}
 
@@ -250,7 +252,7 @@ func (s *MetadataStorage) Store(host string, pathHash PathHash, meta *SourceMeta
 	}
 
 	// Atomic rename
-	if err := os.Rename(tmpPath, path); err != nil {
+	if err := os.Rename(tmpPath, path); err != nil { //nolint:gosec // path derived from content hash
 		return fmt.Errorf("failed to rename temp file: %w", err)
 	}
 
@@ -393,7 +395,7 @@ func (s *VariantStorage) Store(key VariantKey, r io.Reader, contentType string)
 	}
 
 	// Atomic rename content
-	if err := os.Rename(tmpPath, path); err != nil {
+	if err := os.Rename(tmpPath, path); err != nil { //nolint:gosec // path derived from content hash
 		return 0, fmt.Errorf("failed to rename temp file: %w", err)
 	}
 
@@ -409,7 +411,7 @@ func (s *VariantStorage) Store(key VariantKey, r io.Reader, contentType string)
 		return 0, fmt.Errorf("failed to marshal metadata: %w", err)
 	}
 
-	if err := os.WriteFile(metaPath, metaData, 0640); err != nil {
+	if err := os.WriteFile(metaPath, metaData, StorageFilePerm); err != nil {
 		// Non-fatal, content is stored
 		_ = err
 	}