Update golangci-lint to v2.12.2 with canonical config

Bump golangci-lint from v2.10.1 to v2.12.2 in the Dockerfile lint
stage (tag+digest pin) and script/bootstrap release-archive pins
(linux amd64/arm64 sha256s). Replace .golangci.yml with the canonical
v2-layout config so linter settings (lll 88, funlen 80/50, cyclop 15,
dupl 100) actually apply.

Fix all findings surfaced by the new linter and config:

- noctx: use httptest.NewRequestWithContext in all tests
- gosec G710/G703: route app redirects through a path-escaping
  redirectToApp helper; annotate internal log path usage
- goconst: introduce shared constants for template/JSON keys and
  repeated test literals
- lll: wrap lines to the 88-column limit
- dupl: extract shared helpers (generic findAllByAppID in models,
  deleteAppResource in handlers, parsePush in webhook payloads,
  table-driven/helper-based test dedup)
- nolintlint: drop nolint directives made obsolete by the new limits

Record the change in TODO.md; make check is green.

internal/handlers/api.go

@@ -84,7 +84,7 @@ func (h *Handlers) HandleAPILoginPOST() http.HandlerFunc {
 		decodeErr := json.NewDecoder(request.Body).Decode(&req)
 		if decodeErr != nil {
 			h.respondJSON(writer, request,
-				map[string]string{"error": "invalid JSON body"},
+				map[string]string{jsonKeyError: "invalid JSON body"},
 				http.StatusBadRequest)
 
 			return
@@ -95,7 +95,7 @@ func (h *Handlers) HandleAPILoginPOST() http.HandlerFunc {
 
 		if username == "" || credential == "" {
 			h.respondJSON(writer, request,
-				map[string]string{"error": "username and password are required"},
+				map[string]string{jsonKeyError: "username and password are required"},
 				http.StatusBadRequest)
 
 			return
@@ -104,7 +104,7 @@ func (h *Handlers) HandleAPILoginPOST() http.HandlerFunc {
 		user, authErr := h.auth.Authenticate(request.Context(), username, credential)
 		if authErr != nil {
 			h.respondJSON(writer, request,
-				map[string]string{"error": "invalid credentials"},
+				map[string]string{jsonKeyError: "invalid credentials"},
 				http.StatusUnauthorized)
 
 			return
@@ -114,7 +114,7 @@ func (h *Handlers) HandleAPILoginPOST() http.HandlerFunc {
 		if sessionErr != nil {
 			h.log.Error("api: failed to create session", "error", sessionErr)
 			h.respondJSON(writer, request,
-				map[string]string{"error": "failed to create session"},
+				map[string]string{jsonKeyError: "failed to create session"},
 				http.StatusInternalServerError)
 
 			return
@@ -133,7 +133,7 @@ func (h *Handlers) HandleAPIListApps() http.HandlerFunc {
 		apps, err := h.appService.ListApps(request.Context())
 		if err != nil {
 			h.respondJSON(writer, request,
-				map[string]string{"error": "failed to list apps"},
+				map[string]string{jsonKeyError: "failed to list apps"},
 				http.StatusInternalServerError)
 
 			return
@@ -156,7 +156,7 @@ func (h *Handlers) HandleAPIGetApp() http.HandlerFunc {
 		application, err := h.appService.GetApp(request.Context(), appID)
 		if err != nil {
 			h.respondJSON(writer, request,
-				map[string]string{"error": "internal server error"},
+				map[string]string{jsonKeyError: "internal server error"},
 				http.StatusInternalServerError)
 
 			return
@@ -164,7 +164,7 @@ func (h *Handlers) HandleAPIGetApp() http.HandlerFunc {
 
 		if application == nil {
 			h.respondJSON(writer, request,
-				map[string]string{"error": "app not found"},
+				map[string]string{jsonKeyError: "app not found"},
 				http.StatusNotFound)
 
 			return
@@ -185,7 +185,7 @@ func (h *Handlers) HandleAPIListDeployments() http.HandlerFunc {
 		application, err := h.appService.GetApp(request.Context(), appID)
 		if err != nil || application == nil {
 			h.respondJSON(writer, request,
-				map[string]string{"error": "app not found"},
+				map[string]string{jsonKeyError: "app not found"},
 				http.StatusNotFound)
 
 			return
@@ -205,7 +205,7 @@ func (h *Handlers) HandleAPIListDeployments() http.HandlerFunc {
 		)
 		if deployErr != nil {
 			h.respondJSON(writer, request,
-				map[string]string{"error": "failed to list deployments"},
+				map[string]string{jsonKeyError: "failed to list deployments"},
 				http.StatusInternalServerError)
 
 			return
@@ -231,7 +231,7 @@ func (h *Handlers) HandleAPIWhoAmI() http.HandlerFunc {
 		user, err := h.auth.GetCurrentUser(request.Context(), request)
 		if err != nil || user == nil {
 			h.respondJSON(writer, request,
-				map[string]string{"error": "unauthorized"},
+				map[string]string{jsonKeyError: "unauthorized"},
 				http.StatusUnauthorized)
 
 			return