fix: resolve all 47 noctx lint findings in tests

Replace every httptest.NewRequest call with
httptest.NewRequestWithContext using the test's t.Context(). Thread
t *testing.T through the createSetupFormRequest and
createLoginFormRequest helpers so they can supply a context.

make lint under golangci-lint 2.12.2 drops from 94 findings to 47
(remaining: 23 gosec, 24 goconst, tracked in #176/#177/#178). make
test and make fmt-check pass unchanged.

Closes #175

TODO.md

@@ -10,18 +10,23 @@
 
 # Status
 
-1.0+. Tagged 1.0.0 on 2026-02-26; 8 commits on main since. Policy
-violation: main currently fails make check (91 lint issues), so the tree
-is out of compliance until fixed.
+1.0+. Tagged 1.0.0 on 2026-02-26. Policy violation: main currently
+fails make check under golangci-lint >= 2.12 (47 lint issues remaining:
+23 gosec, 24 goconst), so the tree is out of compliance until fixed. CI
+(Dockerfile lint stage, pinned golangci-lint v2.10.1) is green; the pin
+bump is tracked in issue #179. The road to release 1.1.0 is tracked in
+Gitea issues #175-#182 (milestone 1.1.0).
 
 # Next Step
 
-Fix the 47 noctx lint findings (HTTP requests without context) in one
-commit and confirm the count drops under make check. This is the largest
-of the three lint classes blocking a green main.
+Fix the 22 gosec G710 open-redirect findings in
+internal/handlers/app.go (issue #176) by validating app IDs in a
+shared redirect helper.
 
 # Completed Steps
 
+- 2026-08-07: Fixed all 47 noctx lint findings: tests now use
+  httptest.NewRequestWithContext with t.Context() (#175).
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-03-11: Monolithic env var editing with bulk save (#158).
@@ -45,11 +50,14 @@ of the three lint classes blocking a green main.
 # Future Steps
 
 - Get main green (compliance, ordered):
-    - Fix 47 noctx findings (Next Step).
-    - Fix 23 gosec findings.
-    - Fix 21 goconst findings.
+    - Fix 22 gosec G710 findings (Next Step, #176).
+    - Fix 1 gosec G703 finding (#177).
+    - Fix 24 goconst findings (#178).
+    - Bump Dockerfile golangci-lint pin to v2.12.x (#179).
     - Run make check clean on main and keep it green; main must always
       pass.
 - Confirm .gitea/workflows/check.yml gates merges on make check so main
-  cannot regress.
+  cannot regress (#180).
+- Deploy to fsn1app1 and verify end-to-end (#181), then tag 1.1.0
+  (#182).
 - Resume feature work only after main is green.