Update golangci-lint to v2.12.2 with canonical config

Bump golangci-lint from v2.10.1 to v2.12.2 in the Dockerfile lint
stage (tag+digest pin) and script/bootstrap release-archive pins
(linux amd64/arm64 sha256s). Replace .golangci.yml with the canonical
v2-layout config so linter settings (lll 88, funlen 80/50, cyclop 15,
dupl 100) actually apply.

Fix all findings surfaced by the new linter and config:

- noctx: use httptest.NewRequestWithContext in all tests
- gosec G710/G703: route app redirects through a path-escaping
  redirectToApp helper; annotate internal log path usage
- goconst: introduce shared constants for template/JSON keys and
  repeated test literals
- lll: wrap lines to the 88-column limit
- dupl: extract shared helpers (generic findAllByAppID in models,
  deleteAppResource in handlers, parsePush in webhook payloads,
  table-driven/helper-based test dedup)
- nolintlint: drop nolint directives made obsolete by the new limits

Record the change in TODO.md; make check is green.

internal/models/env_var.go

@@ -93,6 +93,41 @@ func FindEnvVar(
 	return envVar, nil
 }
 
+// findAllByAppID loads all rows for an app, scanning each row into a
+// new model created by newFn. entity names the model in error messages.
+func findAllByAppID[T interface{ scanDest() []any }](
+	ctx context.Context,
+	db *database.Database,
+	query, appID, entity string,
+	newFn func(*database.Database) T,
+) ([]T, error) {
+	rows, err := db.Query(ctx, query, appID)
+	if err != nil {
+		return nil, fmt.Errorf("querying %s by app: %w", entity, err)
+	}
+
+	defer func() { _ = rows.Close() }()
+
+	var items []T
+
+	for rows.Next() {
+		item := newFn(db)
+
+		scanErr := rows.Scan(item.scanDest()...)
+		if scanErr != nil {
+			return nil, scanErr
+		}
+
+		items = append(items, item)
+	}
+
+	return items, rows.Err()
+}
+
+func (e *EnvVar) scanDest() []any {
+	return []any{&e.ID, &e.AppID, &e.Key, &e.Value}
+}
+
 // FindEnvVarsByAppID finds all env vars for an app.
 func FindEnvVarsByAppID(
 	ctx context.Context,
@@ -103,29 +138,7 @@ func FindEnvVarsByAppID(
 		SELECT id, app_id, key, value FROM app_env_vars
 		WHERE app_id = ? ORDER BY key`
 
-	rows, err := db.Query(ctx, query, appID)
-	if err != nil {
-		return nil, fmt.Errorf("querying env vars by app: %w", err)
-	}
-
-	defer func() { _ = rows.Close() }()
-
-	var envVars []*EnvVar
-
-	for rows.Next() {
-		envVar := NewEnvVar(db)
-
-		scanErr := rows.Scan(
-			&envVar.ID, &envVar.AppID, &envVar.Key, &envVar.Value,
-		)
-		if scanErr != nil {
-			return nil, scanErr
-		}
-
-		envVars = append(envVars, envVar)
-	}
-
-	return envVars, rows.Err()
+	return findAllByAppID(ctx, db, query, appID, "env vars", NewEnvVar)
 }
 
 // EnvVarPair is a key-value pair for bulk env var operations.