fix: resolve all golangci-lint issues

Fixes #32

Changes:
- middleware.go: use max() builtin, strconv.Itoa, fix wsl whitespace
- database.go: fix nlreturn, noinlineerr, wsl whitespace
- handlers.go: remove unnecessary template.HTML conversion, unused import
- app.go: extract cleanupContainer to fix nestif, fix lll
- client.go: break long string literals to fix lll
- deploy.go: fix wsl whitespace
- auth_test.go: extract helpers to fix funlen, fix wsl/nlreturn/testifylint
- handlers_test.go: deduplicate IDOR tests, fix paralleltest
- validation_test.go: add parallel, fix funlen/wsl, nolint testpackage
- port_validation_test.go: add parallel, nolint testpackage
- ratelimit_test.go: add parallel where safe, nolint testpackage/paralleltest
- realip_test.go: add parallel, use NewRequestWithContext, fix wsl/funlen
- user.go: (noinlineerr already fixed by database.go pattern)

internal/docker/client.go

@@ -611,10 +611,13 @@ func (c *Client) createGitContainer(
 	var script string
 	if cfg.commitSHA != "" {
 		// Clone without depth limit so we can checkout any commit, then checkout specific SHA
-		script = `git clone --branch "$CLONE_BRANCH" "$CLONE_URL" /repo && cd /repo && git checkout "$CLONE_SHA" && echo COMMIT:$(git rev-parse HEAD)`
+		script = `git clone --branch "$CLONE_BRANCH" "$CLONE_URL" /repo` +
+			` && cd /repo && git checkout "$CLONE_SHA"` +
+			` && echo COMMIT:$(git rev-parse HEAD)`
 	} else {
 		// Shallow clone of branch HEAD, then output commit SHA
-		script = `git clone --depth 1 --branch "$CLONE_BRANCH" "$CLONE_URL" /repo && cd /repo && echo COMMIT:$(git rev-parse HEAD)`
+		script = `git clone --depth 1 --branch "$CLONE_BRANCH" "$CLONE_URL" /repo` +
+			` && cd /repo && echo COMMIT:$(git rev-parse HEAD)`
 	}
 
 	env := []string{

internal/docker/validation_test.go

@@ -1,4 +1,4 @@
-package docker
+package docker //nolint:testpackage // tests unexported regexps and Client struct
 
 import (
 	"errors"
@@ -7,6 +7,8 @@ import (
 )
 
 func TestValidBranchRegex(t *testing.T) {
+	t.Parallel()
+
 	valid := []string{
 		"main",
 		"develop",
@@ -40,6 +42,8 @@ func TestValidBranchRegex(t *testing.T) {
 }
 
 func TestValidCommitSHARegex(t *testing.T) {
+	t.Parallel()
+
 	valid := []string{
 		"abc123def456789012345678901234567890abcd",
 		"0000000000000000000000000000000000000000",
@@ -66,7 +70,9 @@ func TestValidCommitSHARegex(t *testing.T) {
 	}
 }
 
-func TestCloneRepoRejectsInjection(t *testing.T) {
+func TestCloneRepoRejectsInjection(t *testing.T) { //nolint:funlen // table-driven test
+	t.Parallel()
+
 	c := &Client{
 		log: slog.Default(),
 	}
@@ -119,6 +125,8 @@ func TestCloneRepoRejectsInjection(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
 			_, err := c.CloneRepo(
 				t.Context(),
 				"git@example.com:repo.git",
@@ -131,6 +139,7 @@ func TestCloneRepoRejectsInjection(t *testing.T) {
 			if err == nil {
 				t.Fatal("expected error, got nil")
 			}
+
 			if !errors.Is(err, tt.wantErr) {
 				t.Errorf("expected error %v, got %v", tt.wantErr, err)
 			}