Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/waf/admin.go

@@ -31,7 +31,8 @@ var (
 	errNotBanToAdd = errors.New(
 		"the body is not a JSON object of netblock, duration and reason")
 	errNotNetblock = errors.New(
-		"is not an address or a netblock, such as 203.0.113.9 or 203.0.113.0/24")
+		"is not an address or a netblock, such as 203.0.113.9 or 203.0.113.0/24",
+	)
 	errMappedNetblock = errors.New(
 		"is IPv4-mapped: give the IPv4 netblock, such as 203.0.113.0/24")
 	errZone        = errors.New("has a zone, which a netblock cannot have")
@@ -61,10 +62,18 @@ func (rq *request) answerAdmin() {
 
 	switch {
 	case token == "":
-		http.Error(rq.out, http.StatusText(http.StatusNotFound), http.StatusNotFound)
+		http.Error(
+			rq.out,
+			http.StatusText(http.StatusNotFound),
+			http.StatusNotFound,
+		)
 	case !hasToken(rq.in, token):
 		rq.out.Header().Set("WWW-Authenticate", "Bearer")
-		http.Error(rq.out, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
+		http.Error(
+			rq.out,
+			http.StatusText(http.StatusUnauthorized),
+			http.StatusUnauthorized,
+		)
 	default:
 		answer()
 	}
@@ -150,7 +159,9 @@ func (rq *request) addBan() {
 // readBanToAdd reads the body of POST BansPath: a JSON object with
 // nothing but whitespace after it, in at most banBodyMaxBytes.
 func (rq *request) readBanToAdd() (banToAdd, error) {
-	data, err := io.ReadAll(http.MaxBytesReader(nil, rq.in.Body, banBodyMaxBytes))
+	data, err := io.ReadAll(
+		http.MaxBytesReader(nil, rq.in.Body, banBodyMaxBytes),
+	)
 	rq.requestBytes = int64(len(data))
 
 	if err != nil {
@@ -170,7 +181,10 @@ func (rq *request) readBanToAdd() (banToAdd, error) {
 	// Token returns io.EOF only when nothing but whitespace is left.
 	_, err = decoder.Token()
 	if !errors.Is(err, io.EOF) {
-		return banToAdd{}, fmt.Errorf("%w: more follows the object", errNotBanToAdd)
+		return banToAdd{}, fmt.Errorf(
+			"%w: more follows the object",
+			errNotBanToAdd,
+		)
 	}
 
 	return toAdd, nil
@@ -185,7 +199,11 @@ func (h *handler) banNetblock(value string) (netip.Prefix, error) {
 	netblock, err := netip.ParsePrefix(value)
 	if err == nil {
 		if netblock.Addr().Is4In6() {
-			return netip.Prefix{}, fmt.Errorf("netblock %q %w", value, errMappedNetblock)
+			return netip.Prefix{}, fmt.Errorf(
+				"netblock %q %w",
+				value,
+				errMappedNetblock,
+			)
 		}
 
 		return netblock, nil
@@ -195,7 +213,11 @@ func (h *handler) banNetblock(value string) (netip.Prefix, error) {
 	// 2001:db8::1%x/48 as part of the zone.
 	addr, err := netip.ParseAddr(value)
 	if err != nil {
-		return netip.Prefix{}, fmt.Errorf("netblock %q %w", value, errNotNetblock)
+		return netip.Prefix{}, fmt.Errorf(
+			"netblock %q %w",
+			value,
+			errNotNetblock,
+		)
 	}
 
 	if addr.Zone() != "" {
@@ -214,7 +236,11 @@ func expiry(duration string, now time.Time) (time.Time, error) {
 
 	length, err := config.ParseDurationNotOff(duration)
 	if err != nil {
-		return time.Time{}, fmt.Errorf("duration %q %w", duration, errNotDuration)
+		return time.Time{}, fmt.Errorf(
+			"duration %q %w",
+			duration,
+			errNotDuration,
+		)
 	}
 
 	return now.Add(length), nil
@@ -233,7 +259,11 @@ func (rq *request) liftBans() {
 
 	lifted := rq.h.ledger.Lift(client, rq.h.now())
 	if len(lifted) == 0 {
-		http.Error(rq.out, "no ban is active on "+client.String(), http.StatusNotFound)
+		http.Error(
+			rq.out,
+			"no ban is active on "+client.String(),
+			http.StatusNotFound,
+		)
 
 		return
 	}
@@ -261,7 +291,9 @@ func (rq *request) showClient() {
 		return
 	}
 
-	answer := clientAnswer{Bans: state.BanEntries(rq.h.ledger.Covering(addr))}
+	answer := clientAnswer{
+		Bans: state.BanEntries(rq.h.ledger.Covering(addr)),
+	}
 
 	client, seen := rq.h.limiter.Client(rq.h.clientGroup(addr))
 	if seen {
@@ -294,7 +326,11 @@ func (rq *request) answerBans(held []bans.Ban) {
 func (rq *request) answerJSON(value any) {
 	body, err := json.MarshalIndent(value, "", "    ")
 	if err != nil {
-		rq.h.processLog.Error("encoding an answer failed", "error", err.Error())
+		rq.h.processLog.Error(
+			"encoding an answer failed",
+			"error",
+			err.Error(),
+		)
 		http.Error(rq.out, http.StatusText(http.StatusInternalServerError),
 			http.StatusInternalServerError)