Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/bans/snapshot_test.go

@@ -29,8 +29,16 @@ func TestChangedAfterABanIsMade(t *testing.T) {
 	wantChanged(t, ledger, false)
 
 	// Two bans before the value is read leave one.
-	ledger.BanForLimit(netip.MustParsePrefix("203.0.113.10/32"), midnight(), bans.Notes{})
-	ledger.BanForLimit(netip.MustParsePrefix("203.0.113.11/32"), midnight(), bans.Notes{})
+	ledger.BanForLimit(
+		netip.MustParsePrefix("203.0.113.10/32"),
+		midnight(),
+		bans.Notes{},
+	)
+	ledger.BanForLimit(
+		netip.MustParsePrefix("203.0.113.11/32"),
+		midnight(),
+		bans.Notes{},
+	)
 	wantChanged(t, ledger, true)
 	wantChanged(t, ledger, false)
 }
@@ -52,7 +60,10 @@ func TestSnapshotListsEveryBanByNetblock(t *testing.T) {
 
 	got := make([]string, 0, len(snapshot))
 	for _, ban := range snapshot {
-		got = append(got, ban.Netblock.String()+" "+ban.Start.Format(time.Kitchen))
+		got = append(
+			got,
+			ban.Netblock.String()+" "+ban.Start.Format(time.Kitchen),
+		)
 	}
 
 	want := []string{
@@ -77,7 +88,10 @@ func TestLoadedBansCarryOn(t *testing.T) {
 	after := bans.New(defaultParams())
 	after.Load(before.Snapshot())
 
-	_, banned, _ := after.Check(netblock.Addr(), ban.Expires.Add(-time.Second))
+	_, banned, _ := after.Check(
+		netblock.Addr(),
+		ban.Expires.Add(-time.Second),
+	)
 	if !banned {
 		t.Error("the loaded ban does not refuse")
 	}
@@ -85,8 +99,11 @@ func TestLoadedBansCarryOn(t *testing.T) {
 	again, _ := after.BanForLimit(netblock, ban.Expires, bans.Notes{})
 	if again.Expires.Sub(again.Start) != 3*time.Hour ||
 		again.Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
-		t.Errorf("the next ban lasts %s with earlier bans %+v, want 3h and 1 for a limit",
-			again.Expires.Sub(again.Start), again.Notes.EarlierBans)
+		t.Errorf(
+			"the next ban lasts %s with earlier bans %+v, want 3h and 1 for a limit",
+			again.Expires.Sub(again.Start),
+			again.Notes.EarlierBans,
+		)
 	}
 }
 
@@ -98,10 +115,20 @@ func TestLoadedBanRefusesEveryClientInItsNetblock(t *testing.T) {
 	// ban covers, beside a ban the ledger makes on one IPv4 address.
 	ledger := bans.New(defaultParams())
 	ledger.Load([]bans.Ban{
-		{Netblock: netip.MustParsePrefix("203.0.113.9/24"), Start: midnight()},
-		{Netblock: netip.MustParsePrefix("2001:db8::1/48"), Start: midnight()},
+		{
+			Netblock: netip.MustParsePrefix("203.0.113.9/24"),
+			Start:    midnight(),
+		},
+		{
+			Netblock: netip.MustParsePrefix("2001:db8::1/48"),
+			Start:    midnight(),
+		},
 	})
-	ledger.BanForLimit(netip.MustParsePrefix("198.51.100.7/32"), midnight(), bans.Notes{})
+	ledger.BanForLimit(
+		netip.MustParsePrefix("198.51.100.7/32"),
+		midnight(),
+		bans.Notes{},
+	)
 
 	for client, want := range map[string]bool{
 		"203.0.113.0":     true,
@@ -138,7 +165,10 @@ func TestPermanentBanStartedBeforeAnEndedOneRefuses(t *testing.T) {
 	// As when an admin adds a permanent ban to bans.json with a start
 	// before that of the netblock's ban that has ended.
 	netblock := netip.MustParsePrefix("203.0.113.0/24")
-	permanent := bans.Ban{Netblock: netblock, Start: midnight().Add(-time.Hour)}
+	permanent := bans.Ban{
+		Netblock: netblock,
+		Start:    midnight().Add(-time.Hour),
+	}
 	ended := bans.Ban{
 		Netblock: netblock,
 		Start:    midnight(),
@@ -153,20 +183,31 @@ func TestPermanentBanStartedBeforeAnEndedOneRefuses(t *testing.T) {
 
 	ban, banned, _ := ledger.Find(client, now)
 	if !banned || !ban.Permanent() {
-		t.Errorf("find gives %+v and %t, want the permanent ban", ban, banned)
+		t.Errorf(
+			"find gives %+v and %t, want the permanent ban",
+			ban,
+			banned,
+		)
 	}
 
 	ban, banned, _ = ledger.Check(client, now)
 	if !banned || !ban.Permanent() {
-		t.Errorf("the client is refused: %t, under %+v, want under the permanent ban",
-			banned, ban)
+		t.Errorf(
+			"the client is refused: %t, under %+v, want under the permanent ban",
+			banned,
+			ban,
+		)
 	}
 
 	// A limit broken now makes no shorter ban over the permanent one.
 	ban, _ = ledger.BanForLimit(netblock, now, bans.Notes{})
 	if !ban.Permanent() || len(ledger.Bans(netblock)) != 2 {
-		t.Errorf("a broken limit returned %+v and left the netblock %d bans, "+
-			"want the permanent ban and 2", ban, len(ledger.Bans(netblock)))
+		t.Errorf(
+			"a broken limit returned %+v and left the netblock %d bans, "+
+				"want the permanent ban and 2",
+			ban,
+			len(ledger.Bans(netblock)),
+		)
 	}
 }
 
@@ -195,7 +236,11 @@ func TestNextBanWorkedOutFromTheBanThatEndedLast(t *testing.T) {
 	// Once both have ended, a limit broken within the repeat window bans
 	// for three times the 9 hours, and the notes count the two bans
 	// before the 9-hour one and it, for a limit, and the admin's.
-	ban, _ := ledger.BanForLimit(netblock, nineHours.Expires.Add(time.Hour), bans.Notes{})
+	ban, _ := ledger.BanForLimit(
+		netblock,
+		nineHours.Expires.Add(time.Hour),
+		bans.Notes{},
+	)
 	if ban.Expires.Sub(ban.Start) != 27*time.Hour ||
 		ban.Notes.EarlierBans != (bans.EarlierBans{Limit: 3, Admin: 1}) {
 		t.Errorf("the next ban lasts %s with earlier bans %+v, "+
@@ -226,7 +271,10 @@ func TestLoadKeepsAtMostMaxBansDroppingTheEarliest(t *testing.T) {
 
 	held := ledger.Snapshot()
 	if len(held) != 1 || !reflect.DeepEqual(held[0], later) {
-		t.Errorf("the ledger holds %+v, want only the ban that began later", held)
+		t.Errorf(
+			"the ledger holds %+v, want only the ban that began later",
+			held,
+		)
 	}
 }
 
@@ -256,16 +304,25 @@ func TestLoadReplacesTheBansHeld(t *testing.T) {
 	// bans.json is taken in, that ban is lifted.
 	ledger.Load([]bans.Ban{kept})
 
-	_, banned, _ := ledger.Check(netip.MustParseAddr("203.0.113.9"), midnight())
+	_, banned, _ := ledger.Check(
+		netip.MustParseAddr("203.0.113.9"),
+		midnight(),
+	)
 	if banned {
 		t.Error("a ban left out of the second load still refuses")
 	}
 
 	// The ledger holds one ban, so it makes two more without dropping any.
-	first, _ := ledger.BanForLimit(netip.MustParsePrefix("198.51.100.7/32"), midnight(),
-		bans.Notes{})
-	second, _ := ledger.BanForLimit(netip.MustParsePrefix("198.51.100.8/32"), midnight(),
-		bans.Notes{})
+	first, _ := ledger.BanForLimit(
+		netip.MustParsePrefix("198.51.100.7/32"),
+		midnight(),
+		bans.Notes{},
+	)
+	second, _ := ledger.BanForLimit(
+		netip.MustParsePrefix("198.51.100.8/32"),
+		midnight(),
+		bans.Notes{},
+	)
 
 	want := []bans.Ban{first, second, kept}
 	if got := ledger.Snapshot(); !reflect.DeepEqual(got, want) {