Update golangci-lint to v2.12.2 with canonical config

Bump golangci-lint from v2.10.1 to v2.12.2 in the Dockerfile lint
stage (tag+digest pin) and script/bootstrap release-archive pins
(linux amd64/arm64 sha256s). Replace .golangci.yml with the canonical
v2-layout config so linter settings (lll 88, funlen 80/50, cyclop 15,
dupl 100) actually apply.

Fix all findings surfaced by the new linter and config:

- noctx: use httptest.NewRequestWithContext in all tests
- gosec G710/G703: route app redirects through a path-escaping
  redirectToApp helper; annotate internal log path usage
- goconst: introduce shared constants for template/JSON keys and
  repeated test literals
- lll: wrap lines to the 88-column limit
- dupl: extract shared helpers (generic findAllByAppID in models,
  deleteAppResource in handlers, parsePush in webhook payloads,
  table-driven/helper-based test dedup)
- nolintlint: drop nolint directives made obsolete by the new limits

Record the change in TODO.md; make check is green.

TODO.md

@@ -10,18 +10,20 @@
 
 # Status
 
-1.0+. Tagged 1.0.0 on 2026-02-26; 8 commits on main since. Policy
-violation: main currently fails make check (91 lint issues), so the tree
-is out of compliance until fixed.
+1.0+. Tagged 1.0.0 on 2026-02-26; 8 commits on main since. `make check`
+is green as of the golangci-lint v2.12.2 update.
 
 # Next Step
 
-Fix the 47 noctx lint findings (HTTP requests without context) in one
-commit and confirm the count drops under make check. This is the largest
-of the three lint classes blocking a green main.
+Confirm `.gitea/workflows/check.yml` gates merges on `make check` so
+main cannot regress.
 
 # Completed Steps
 
+- 2026-08-07: Updated golangci-lint to v2.12.2 (canonical
+  `.golangci.yml`, `Dockerfile` lint stage pin, `script/bootstrap`
+  release-archive pins) and fixed all resulting lint findings (noctx,
+  gosec, goconst, lll, dupl, nolintlint); `make check` green.
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-03-11: Monolithic env var editing with bulk save (#158).
@@ -44,12 +46,4 @@ of the three lint classes blocking a green main.
 
 # Future Steps
 
-- Get main green (compliance, ordered):
-    - Fix 47 noctx findings (Next Step).
-    - Fix 23 gosec findings.
-    - Fix 21 goconst findings.
-    - Run make check clean on main and keep it green; main must always
-      pass.
-- Confirm .gitea/workflows/check.yml gates merges on make check so main
-  cannot regress.
 - Resume feature work only after main is green.