Update golangci-lint to v2.12.2 with canonical config

Bump golangci-lint from v2.10.1 to v2.12.2 in the Dockerfile lint
stage (tag+digest pin) and script/bootstrap release-archive pins
(linux amd64/arm64 sha256s). Replace .golangci.yml with the canonical
v2-layout config so linter settings (lll 88, funlen 80/50, cyclop 15,
dupl 100) actually apply.

Fix all findings surfaced by the new linter and config:

- noctx: use httptest.NewRequestWithContext in all tests
- gosec G710/G703: route app redirects through a path-escaping
  redirectToApp helper; annotate internal log path usage
- goconst: introduce shared constants for template/JSON keys and
  repeated test literals
- lll: wrap lines to the 88-column limit
- dupl: extract shared helpers (generic findAllByAppID in models,
  deleteAppResource in handlers, parsePush in webhook payloads,
  table-driven/helper-based test dedup)
- nolintlint: drop nolint directives made obsolete by the new limits

Record the change in TODO.md; make check is green.

internal/handlers/repo_url_validation.go

@@ -11,13 +11,17 @@ import (
 var (
 	errRepoURLEmpty   = errors.New("repository URL must not be empty")
 	errRepoURLScheme  = errors.New("file:// URLs are not allowed for security reasons")
-	errRepoURLInvalid = errors.New("repository URL must use https://, http://, ssh://, git://, or git@host:path format")
-	errRepoURLNoHost  = errors.New("repository URL must include a host")
-	errRepoURLNoPath  = errors.New("repository URL must include a path")
+	errRepoURLInvalid = errors.New(
+		"repository URL must use https://, http://, ssh://, git://, " +
+			"or git@host:path format",
+	)
+	errRepoURLNoHost = errors.New("repository URL must include a host")
+	errRepoURLNoPath = errors.New("repository URL must include a path")
 )
 
-// scpLikeRepoRe matches SCP-like git URLs: git@host:path (e.g. git@github.com:user/repo.git).
-// Only the "git" user is allowed, as that is the standard for SSH deploy keys.
+// scpLikeRepoRe matches SCP-like git URLs: git@host:path
+// (e.g. git@github.com:user/repo.git). Only the "git" user is allowed,
+// as that is the standard for SSH deploy keys.
 var scpLikeRepoRe = regexp.MustCompile(`^git@[a-zA-Z0-9._-]+:.+$`)
 
 // allowedRepoSchemes lists the URL schemes accepted for repository URLs.
@@ -30,7 +34,8 @@ var allowedRepoSchemes = map[string]bool{
 	"git":   true,
 }
 
-// validateRepoURL checks that the given repository URL is valid and uses an allowed scheme.
+// validateRepoURL checks that the given repository URL is valid and
+// uses an allowed scheme.
 func validateRepoURL(repoURL string) error {
 	if strings.TrimSpace(repoURL) == "" {
 		return errRepoURLEmpty