Format Go with gofmt, then golines -m 77 (closes #215)

script/fmt now runs golines -m 77 after gofmt, repeating golines until
it changes nothing, since one pass can leave a line the next splits.
script/fmt-check fails when either would change a file.
script/bootstrap installs golines v0.13.0 with go install, pinned to
its commit, and checks the installed version with go version -m.

The tree is reformatted. The longer lines this makes are fixed by
hand: nolint directives moved onto their own line above the statement,
one string split, and 20 functions over funlen's 80 lines shortened or
split, RunWAF and limitPercentages among them.

Model: opus-5-5

internal/ratelimit/ratelimit.go

@@ -241,7 +241,8 @@ func (l *Limiter) OverARateLimit(client netip.Prefix, now time.Time) bool {
 	buckets := c.buckets()
 
 	for i, w := range l.windows {
-		if w.limit > 0 && buckets[i].Add(now, w.length, 0)+1 > float64(w.limit) {
+		if w.limit > 0 &&
+			buckets[i].Add(now, w.length, 0)+1 > float64(w.limit) {
 			return true
 		}
 	}
@@ -271,7 +272,12 @@ func (l *Limiter) CountRefusal(
 	defer l.mu.Unlock()
 
 	count := l.get(client).MinuteRefusals.Add(now, time.Minute, 1)
-	hit := Hit{Kind: KindRefusals, Window: "minute", Limit: threshold, Count: count}
+	hit := Hit{
+		Kind:   KindRefusals,
+		Window: "minute",
+		Limit:  threshold,
+		Count:  count,
+	}
 
 	return hit, count > float64(threshold)
 }
@@ -292,7 +298,11 @@ func (l *Limiter) Reset(client netip.Prefix) {
 
 // AddToHistory adds r, a request from client at now, to the client's
 // history.
-func (l *Limiter) AddToHistory(client netip.Prefix, now time.Time, r Request) {
+func (l *Limiter) AddToHistory(
+	client netip.Prefix,
+	now time.Time,
+	r Request,
+) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 
@@ -470,7 +480,13 @@ func (l *Limiter) count(
 	for i, w := range l.windows {
 		requestCounts[i] = requestBuckets[i].Add(now, w.length, requests)
 		byteCounts[i] = byteBuckets[i].Add(now, w.length, bytes)
-		limit, byteLimit := percentOf(w.limit, percent), percentOf(w.byteLimit, percent)
+		limit, byteLimit := percentOf(
+			w.limit,
+			percent,
+		), percentOf(
+			w.byteLimit,
+			percent,
+		)
 
 		switch {
 		case hit.Window != "":