Remediate all lint findings under the canonical golangci-lint config

Fix every finding surfaced by the canonical .golangci.yml with
golangci-lint v2.12.2 (refs #61), behavior-preserving throughout:

- err113: dynamic errors replaced with package-level sentinels and %w
  wrapping; direct comparisons converted to errors.Is
- goprintffuncname: printf-style helpers renamed with an f suffix
  (ui.Writer message methods, cli.ReportErrorf, database.Fatalf,
  vaultik stdoutf) and all call sites updated
- revive: stuttering type names renamed (blob.Handler, blob.WithReader,
  blob.ChunkPosition, storage.URL, storage.Info), doc comments added,
  unused parameters blanked, package comments added
- contextcheck/noctx: ctx threaded through blob.Packer
  (AddChunk/Flush/FinalizeBlob/PackChunks) and scanner call sites;
  context-aware exec and sql variants used
- funlen/cyclop/gocognit/nestif/dupl: oversized or duplicated
  functions split into focused helpers across production and test code
- paralleltest/tparallel/thelper/usetesting/testpackage: tests
  parallelized where safe (global log.Initialize kept in the serial
  phase), helpers marked, t.TempDir adopted, external test packages
  where only exported API is used
- gosec: integer conversions clamped or justified, header timeouts
  added, remaining findings suppressed with per-site justifications
- mnd/goconst/lll/wsl_v5/nlreturn/noinlineerr/errcheck and other
  mechanical findings fixed directly

Remove the deprecated log.LogOptions alias (callers migrated to
log.Options). make check is green.

internal/cli/remote.go

@@ -11,6 +11,10 @@ import (
 	"sneak.berlin/go/vaultik/internal/vaultik"
 )
 
+// errNukeNeedsForce guards the destructive 'remote nuke' subcommand.
+var errNukeNeedsForce = errors.New(
+	"remote nuke requires --force (this deletes ALL remote snapshots and blobs)")
+
 // NewRemoteCommand creates the remote command and subcommands
 func NewRemoteCommand() *cobra.Command {
 	cmd := &cobra.Command{
@@ -39,61 +43,20 @@ empty and the next backup starts from scratch.
 
 This is destructive and irreversible. Requires --force.`,
 		Args: cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(cmd *cobra.Command, _ []string) error {
 			if !force {
-				return errors.New("remote nuke requires --force (this deletes ALL remote snapshots and blobs)")
+				return errNukeNeedsForce
 			}
 
-			configPath, err := ResolveConfigPath()
-			if err != nil {
-				return err
-			}
-
-			rootFlags := GetRootFlags()
-
-			return RunWithApp(cmd.Context(), AppOptions{
-				ConfigPath: configPath,
-				LogOptions: log.LogOptions{
-					Verbose: rootFlags.Verbose,
-					Debug:   rootFlags.Debug,
-					Quiet:   rootFlags.Quiet,
-				},
-				Modules: []fx.Option{},
-				Invokes: []fx.Option{
-					fx.Invoke(func(v *vaultik.Vaultik, lc fx.Lifecycle) {
-						lc.Append(fx.Hook{
-							OnStart: func(ctx context.Context) error {
-								go func() {
-									err := v.NukeRemote(true)
-									if err != nil {
-										if !errors.Is(err, context.Canceled) {
-											log.Error("Remote nuke failed", "error", err)
-											ReportErrorf("Remote nuke failed: %v", err)
-											os.Exit(1)
-										}
-									}
-
-									err = v.Shutdowner.Shutdown()
-									if err != nil {
-										log.Error("Failed to shutdown", "error", err)
-									}
-								}()
-
-								return nil
-							},
-							OnStop: func(ctx context.Context) error {
-								v.Cancel()
-
-								return nil
-							},
-						})
-					}),
-				},
-			})
+			return runVaultikApp(cmd, false, false, "Remote nuke failed",
+				func(v *vaultik.Vaultik) error {
+					return v.NukeRemote(true)
+				})
 		},
 	}
 
-	cmd.Flags().BoolVar(&force, "force", false, "Required: confirm destruction of ALL remote data")
+	cmd.Flags().BoolVar(&force, "force", false,
+		"Required: confirm destruction of ALL remote data")
 
 	return cmd
 }
@@ -111,7 +74,7 @@ func newRemoteInfoCommand() *cobra.Command {
 - Count and size of referenced blobs (from all manifests)
 - Count and size of orphaned blobs (not referenced by any manifest)`,
 		Args: cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(cmd *cobra.Command, _ []string) error {
 			// Use unified config resolution
 			configPath, err := ResolveConfigPath()
 			if err != nil {
@@ -122,7 +85,7 @@ func newRemoteInfoCommand() *cobra.Command {
 
 			return RunWithApp(cmd.Context(), AppOptions{
 				ConfigPath: configPath,
-				LogOptions: log.LogOptions{
+				LogOptions: log.Options{
 					Verbose: rootFlags.Verbose,
 					Debug:   rootFlags.Debug,
 					Quiet:   rootFlags.Quiet || jsonOutput,
@@ -131,7 +94,7 @@ func newRemoteInfoCommand() *cobra.Command {
 				Invokes: []fx.Option{
 					fx.Invoke(func(v *vaultik.Vaultik, lc fx.Lifecycle) {
 						lc.Append(fx.Hook{
-							OnStart: func(ctx context.Context) error {
+							OnStart: func(_ context.Context) error {
 								go func() {
 									err := v.RemoteInfo(jsonOutput)
 									if err != nil {
@@ -153,7 +116,7 @@ func newRemoteInfoCommand() *cobra.Command {
 
 								return nil
 							},
-							OnStop: func(ctx context.Context) error {
+							OnStop: func(_ context.Context) error {
 								v.Cancel()
 
 								return nil