Update golangci-lint to v2.12.2 with canonical config

Bump golangci-lint from v2.10.1 to v2.12.2 in the Dockerfile lint
stage (tag+digest pin) and script/bootstrap release-archive pins
(linux amd64/arm64 sha256s). Replace .golangci.yml with the canonical
v2-layout config so linter settings (lll 88, funlen 80/50, cyclop 15,
dupl 100) actually apply.

Fix all findings surfaced by the new linter and config:

- noctx: use httptest.NewRequestWithContext in all tests
- gosec G710/G703: route app redirects through a path-escaping
  redirectToApp helper; annotate internal log path usage
- goconst: introduce shared constants for template/JSON keys and
  repeated test literals
- lll: wrap lines to the 88-column limit
- dupl: extract shared helpers (generic findAllByAppID in models,
  deleteAppResource in handlers, parsePush in webhook payloads,
  table-driven/helper-based test dedup)
- nolintlint: drop nolint directives made obsolete by the new limits

Record the change in TODO.md; make check is green.

internal/models/models_test.go

@@ -317,33 +317,54 @@ func TestAllApps(t *testing.T) {
 
 // EnvVar Tests.
 
+// testKVCreateAndFind exercises the create-and-find round trip shared
+// by key-value models (env vars, labels).
+func testKVCreateAndFind[T any](
+	t *testing.T,
+	wantKey string,
+	create func(db *database.Database, appID string) (int64, error),
+	find func(context.Context, *database.Database, string) ([]T, error),
+	keyOf func(T) string,
+) {
+	t.Helper()
+
+	testDB, cleanup := setupTestDB(t)
+	defer cleanup()
+
+	// Create app first.
+	app := createTestApp(t, testDB)
+
+	id, err := create(testDB, app.ID)
+	require.NoError(t, err)
+	assert.NotZero(t, id)
+
+	found, err := find(context.Background(), testDB, app.ID)
+	require.NoError(t, err)
+	require.Len(t, found, 1)
+	assert.Equal(t, wantKey, keyOf(found[0]))
+}
+
+func saveTestEnvVar(db *database.Database, appID string) (int64, error) {
+	envVar := models.NewEnvVar(db)
+	envVar.AppID = appID
+	envVar.Key = "DATABASE_URL"
+	envVar.Value = "postgres://localhost/db"
+
+	err := envVar.Save(context.Background())
+
+	return envVar.ID, err
+}
+
 func TestEnvVarCRUD(t *testing.T) {
 	t.Parallel()
 
 	t.Run("creates and finds env vars", func(t *testing.T) {
 		t.Parallel()
 
-		testDB, cleanup := setupTestDB(t)
-		defer cleanup()
-
-		// Create app first.
-		app := createTestApp(t, testDB)
-
-		envVar := models.NewEnvVar(testDB)
-		envVar.AppID = app.ID
-		envVar.Key = "DATABASE_URL"
-		envVar.Value = "postgres://localhost/db"
-
-		err := envVar.Save(context.Background())
-		require.NoError(t, err)
-		assert.NotZero(t, envVar.ID)
-
-		envVars, err := models.FindEnvVarsByAppID(
-			context.Background(), testDB, app.ID,
+		testKVCreateAndFind(t, "DATABASE_URL", saveTestEnvVar,
+			models.FindEnvVarsByAppID,
+			func(e *models.EnvVar) string { return e.Key },
 		)
-		require.NoError(t, err)
-		require.Len(t, envVars, 1)
-		assert.Equal(t, "DATABASE_URL", envVars[0].Key)
 	})
 
 	t.Run("deletes env var", func(t *testing.T) {
@@ -375,32 +396,27 @@ func TestEnvVarCRUD(t *testing.T) {
 
 // Label Tests.
 
+func saveTestLabel(db *database.Database, appID string) (int64, error) {
+	label := models.NewLabel(db)
+	label.AppID = appID
+	label.Key = "traefik.enable"
+	label.Value = "true"
+
+	err := label.Save(context.Background())
+
+	return label.ID, err
+}
+
 func TestLabelCRUD(t *testing.T) {
 	t.Parallel()
 
 	t.Run("creates and finds labels", func(t *testing.T) {
 		t.Parallel()
 
-		testDB, cleanup := setupTestDB(t)
-		defer cleanup()
-
-		app := createTestApp(t, testDB)
-
-		label := models.NewLabel(testDB)
-		label.AppID = app.ID
-		label.Key = "traefik.enable"
-		label.Value = "true"
-
-		err := label.Save(context.Background())
-		require.NoError(t, err)
-		assert.NotZero(t, label.ID)
-
-		labels, err := models.FindLabelsByAppID(
-			context.Background(), testDB, app.ID,
+		testKVCreateAndFind(t, "traefik.enable", saveTestLabel,
+			models.FindLabelsByAppID,
+			func(l *models.Label) string { return l.Key },
 		)
-		require.NoError(t, err)
-		require.Len(t, labels, 1)
-		assert.Equal(t, "traefik.enable", labels[0].Key)
 	})
 }
 
@@ -569,7 +585,9 @@ func TestDeploymentFindByAppID(t *testing.T) {
 		require.NoError(t, err)
 	}
 
-	deployments, err := models.FindDeploymentsByAppID(context.Background(), testDB, app.ID, 3)
+	deployments, err := models.FindDeploymentsByAppID(
+		context.Background(), testDB, app.ID, 3,
+	)
 	require.NoError(t, err)
 	assert.Len(t, deployments, 3)
 }
@@ -706,7 +724,6 @@ func TestAppGetWebhookEvents(t *testing.T) {
 
 // Cascade Delete Tests.
 
-//nolint:funlen // Test function with many assertions - acceptable for integration tests
 func TestCascadeDelete(t *testing.T) {
 	t.Parallel()
 
@@ -783,7 +800,8 @@ func TestCascadeDelete(t *testing.T) {
 
 // Resource Limits Tests.
 
-func TestAppResourceLimits(t *testing.T) { //nolint:funlen // integration test with multiple subtests
+//nolint:funlen // integration test with multiple subtests
+func TestAppResourceLimits(t *testing.T) {
 	t.Parallel()
 
 	t.Run("saves and loads CPU limit", func(t *testing.T) {