Update golangci-lint to v2.12.2 with canonical config

Bump golangci-lint from v2.10.1 to v2.12.2 in the Dockerfile lint
stage (tag+digest pin) and script/bootstrap release-archive pins
(linux amd64/arm64 sha256s). Replace .golangci.yml with the canonical
v2-layout config so linter settings (lll 88, funlen 80/50, cyclop 15,
dupl 100) actually apply.

Fix all findings surfaced by the new linter and config:

- noctx: use httptest.NewRequestWithContext in all tests
- gosec G710/G703: route app redirects through a path-escaping
  redirectToApp helper; annotate internal log path usage
- goconst: introduce shared constants for template/JSON keys and
  repeated test literals
- lll: wrap lines to the 88-column limit
- dupl: extract shared helpers (generic findAllByAppID in models,
  deleteAppResource in handlers, parsePush in webhook payloads,
  table-driven/helper-based test dedup)
- nolintlint: drop nolint directives made obsolete by the new limits

Record the change in TODO.md; make check is green.

internal/service/deploy/deploy_container_test.go

@@ -31,7 +31,9 @@ func TestBuildContainerOptionsUsesImageID(t *testing.T) {
 
 	const expectedImageID = docker.ImageID("sha256:abc123def456")
 
-	opts, err := svc.BuildContainerOptionsExported(context.Background(), app, expectedImageID)
+	opts, err := svc.BuildContainerOptionsExported(
+		context.Background(), app, expectedImageID,
+	)
 	if err != nil {
 		t.Fatalf("buildContainerOptions returned error: %v", err)
 	}
@@ -77,14 +79,20 @@ func TestBuildContainerOptionsNoResourceLimits(t *testing.T) {
 	}
 }
 
-func TestBuildContainerOptionsCPULimit(t *testing.T) {
-	t.Parallel()
+// buildOptsForApp saves an app configured by setup and returns the container
+// options built for it.
+func buildOptsForApp(
+	t *testing.T,
+	name string,
+	setup func(app *models.App),
+) docker.CreateContainerOptions {
+	t.Helper()
 
 	db := database.NewTestDatabase(t)
 
 	app := models.NewApp(db)
-	app.Name = "cpulimit"
-	app.CPULimit = sql.NullFloat64{Float64: 0.5, Valid: true}
+	app.Name = name
+	setup(app)
 
 	err := app.Save(context.Background())
 	if err != nil {
@@ -101,6 +109,16 @@ func TestBuildContainerOptionsCPULimit(t *testing.T) {
 		t.Fatalf("buildContainerOptions returned error: %v", err)
 	}
 
+	return opts
+}
+
+func TestBuildContainerOptionsCPULimit(t *testing.T) {
+	t.Parallel()
+
+	opts := buildOptsForApp(t, "cpulimit", func(app *models.App) {
+		app.CPULimit = sql.NullFloat64{Float64: 0.5, Valid: true}
+	})
+
 	if opts.CPULimit != 0.5 {
 		t.Errorf("expected CPULimit=0.5, got %v", opts.CPULimit)
 	}
@@ -109,26 +127,9 @@ func TestBuildContainerOptionsCPULimit(t *testing.T) {
 func TestBuildContainerOptionsMemoryLimit(t *testing.T) {
 	t.Parallel()
 
-	db := database.NewTestDatabase(t)
-
-	app := models.NewApp(db)
-	app.Name = "memlimit"
-	app.MemoryLimit = sql.NullInt64{Int64: 536870912, Valid: true} // 512m
-
-	err := app.Save(context.Background())
-	if err != nil {
-		t.Fatalf("failed to save app: %v", err)
-	}
-
-	log := slog.New(slog.NewTextHandler(os.Stderr, nil))
-	svc := deploy.NewTestService(log)
-
-	opts, err := svc.BuildContainerOptionsExported(
-		context.Background(), app, docker.ImageID("test:latest"),
-	)
-	if err != nil {
-		t.Fatalf("buildContainerOptions returned error: %v", err)
-	}
+	opts := buildOptsForApp(t, "memlimit", func(app *models.App) {
+		app.MemoryLimit = sql.NullInt64{Int64: 536870912, Valid: true} // 512m
+	})
 
 	if opts.MemoryLimit != 536870912 {
 		t.Errorf("expected MemoryLimit=536870912, got %v", opts.MemoryLimit)