Update golangci-lint to v2.12.2 with canonical config

Bump golangci-lint from v2.10.1 to v2.12.2 in the Dockerfile lint
stage (tag+digest pin) and script/bootstrap release-archive pins
(linux amd64/arm64 sha256s). Replace .golangci.yml with the canonical
v2-layout config so linter settings (lll 88, funlen 80/50, cyclop 15,
dupl 100) actually apply.

Fix all findings surfaced by the new linter and config:

- noctx: use httptest.NewRequestWithContext in all tests
- gosec G710/G703: route app redirects through a path-escaping
  redirectToApp helper; annotate internal log path usage
- goconst: introduce shared constants for template/JSON keys and
  repeated test literals
- lll: wrap lines to the 88-column limit
- dupl: extract shared helpers (generic findAllByAppID in models,
  deleteAppResource in handlers, parsePush in webhook payloads,
  table-driven/helper-based test dedup)
- nolintlint: drop nolint directives made obsolete by the new limits

Record the change in TODO.md; make check is green.

internal/database/migrations.go

@@ -32,7 +32,10 @@ var ErrInvalidMigrationFilename = errors.New("invalid migration filename")
 func ParseMigrationVersion(filename string) (int, error) {
 	name := strings.TrimSuffix(filename, ".sql")
 	if name == "" || name == filename {
-		return 0, fmt.Errorf("%w: %q has no .sql extension or is empty", ErrInvalidMigrationFilename, filename)
+		return 0, fmt.Errorf(
+			"%w: %q has no .sql extension or is empty",
+			ErrInvalidMigrationFilename, filename,
+		)
 	}
 
 	// Split on underscore to separate version from description.
@@ -40,7 +43,10 @@ func ParseMigrationVersion(filename string) (int, error) {
 	versionStr, _, _ := strings.Cut(name, "_")
 
 	if versionStr == "" {
-		return 0, fmt.Errorf("%w: %q has empty version prefix", ErrInvalidMigrationFilename, filename)
+		return 0, fmt.Errorf(
+			"%w: %q has empty version prefix",
+			ErrInvalidMigrationFilename, filename,
+		)
 	}
 
 	// Validate the version is purely numeric.
@@ -177,7 +183,12 @@ func ApplyMigrations(ctx context.Context, db *sql.DB, log *slog.Logger) error {
 
 // applyMigrationTx reads and executes a migration file within a transaction,
 // recording the version in schema_migrations on success.
-func applyMigrationTx(ctx context.Context, db *sql.DB, filename string, version int) error {
+func applyMigrationTx(
+	ctx context.Context,
+	db *sql.DB,
+	filename string,
+	version int,
+) error {
 	content, err := migrationsFS.ReadFile("migrations/" + filename)
 	if err != nil {
 		return fmt.Errorf("failed to read migration %s: %w", filename, err)