Remediate all lint findings under the canonical golangci-lint config

Fix every finding surfaced by the canonical .golangci.yml with
golangci-lint v2.12.2 (refs #61), behavior-preserving throughout:

- err113: dynamic errors replaced with package-level sentinels and %w
  wrapping; direct comparisons converted to errors.Is
- goprintffuncname: printf-style helpers renamed with an f suffix
  (ui.Writer message methods, cli.ReportErrorf, database.Fatalf,
  vaultik stdoutf) and all call sites updated
- revive: stuttering type names renamed (blob.Handler, blob.WithReader,
  blob.ChunkPosition, storage.URL, storage.Info), doc comments added,
  unused parameters blanked, package comments added
- contextcheck/noctx: ctx threaded through blob.Packer
  (AddChunk/Flush/FinalizeBlob/PackChunks) and scanner call sites;
  context-aware exec and sql variants used
- funlen/cyclop/gocognit/nestif/dupl: oversized or duplicated
  functions split into focused helpers across production and test code
- paralleltest/tparallel/thelper/usetesting/testpackage: tests
  parallelized where safe (global log.Initialize kept in the serial
  phase), helpers marked, t.TempDir adopted, external test packages
  where only exported API is used
- gosec: integer conversions clamped or justified, header timeouts
  added, remaining findings suppressed with per-site justifications
- mnd/goconst/lll/wsl_v5/nlreturn/noinlineerr/errcheck and other
  mechanical findings fixed directly

Remove the deprecated log.LogOptions alias (callers migrated to
log.Options). make check is green.

internal/crypto/encryption_test.go

@@ -1,13 +1,16 @@
-package crypto
+package crypto_test
 
 import (
 	"bytes"
 	"testing"
 
 	"filippo.io/age"
+	"sneak.berlin/go/vaultik/internal/crypto"
 )
 
 func TestEncryptor(t *testing.T) {
+	t.Parallel()
+
 	// Generate a test key pair
 	identity, err := age.GenerateX25519Identity()
 	if err != nil {
@@ -17,7 +20,7 @@ func TestEncryptor(t *testing.T) {
 	publicKey := identity.Recipient().String()
 
 	// Create encryptor
-	enc, err := NewEncryptor([]string{publicKey})
+	enc, err := crypto.NewEncryptor([]string{publicKey})
 	if err != nil {
 		t.Fatalf("failed to create encryptor: %v", err)
 	}
@@ -43,7 +46,9 @@ func TestEncryptor(t *testing.T) {
 	}
 
 	var decrypted bytes.Buffer
-	if _, err := decrypted.ReadFrom(r); err != nil {
+
+	_, err = decrypted.ReadFrom(r)
+	if err != nil {
 		t.Fatalf("failed to read decrypted data: %v", err)
 	}
 
@@ -53,6 +58,8 @@ func TestEncryptor(t *testing.T) {
 }
 
 func TestEncryptorMultipleRecipients(t *testing.T) {
+	t.Parallel()
+
 	// Generate three test key pairs
 	identity1, err := age.GenerateX25519Identity()
 	if err != nil {
@@ -76,7 +83,7 @@ func TestEncryptorMultipleRecipients(t *testing.T) {
 	}
 
 	// Create encryptor with multiple recipients
-	enc, err := NewEncryptor(publicKeys)
+	enc, err := crypto.NewEncryptor(publicKeys)
 	if err != nil {
 		t.Fatalf("failed to create encryptor: %v", err)
 	}
@@ -99,7 +106,9 @@ func TestEncryptorMultipleRecipients(t *testing.T) {
 		}
 
 		var decrypted bytes.Buffer
-		if _, err := decrypted.ReadFrom(r); err != nil {
+
+		_, err = decrypted.ReadFrom(r)
+		if err != nil {
 			t.Fatalf("recipient %d failed to read decrypted data: %v", i+1, err)
 		}
 
@@ -110,6 +119,8 @@ func TestEncryptorMultipleRecipients(t *testing.T) {
 }
 
 func TestEncryptorUpdateRecipients(t *testing.T) {
+	t.Parallel()
+
 	// Generate two identities
 	identity1, _ := age.GenerateX25519Identity()
 	identity2, _ := age.GenerateX25519Identity()
@@ -118,7 +129,7 @@ func TestEncryptorUpdateRecipients(t *testing.T) {
 	publicKey2 := identity2.Recipient().String()
 
 	// Create encryptor with first key
-	enc, err := NewEncryptor([]string{publicKey1})
+	enc, err := crypto.NewEncryptor([]string{publicKey1})
 	if err != nil {
 		t.Fatalf("failed to create encryptor: %v", err)
 	}
@@ -132,7 +143,8 @@ func TestEncryptorUpdateRecipients(t *testing.T) {
 	}
 
 	// Update to second key
-	if err := enc.UpdateRecipients([]string{publicKey2}); err != nil {
+	err = enc.UpdateRecipients([]string{publicKey2})
+	if err != nil {
 		t.Fatalf("failed to update recipients: %v", err)
 	}
 
@@ -143,20 +155,24 @@ func TestEncryptorUpdateRecipients(t *testing.T) {
 	}
 
 	// First ciphertext should only decrypt with first identity
-	if _, err := age.Decrypt(bytes.NewReader(ciphertext1), identity1); err != nil {
+	_, err = age.Decrypt(bytes.NewReader(ciphertext1), identity1)
+	if err != nil {
 		t.Error("failed to decrypt with identity1")
 	}
 
-	if _, err := age.Decrypt(bytes.NewReader(ciphertext1), identity2); err == nil {
+	_, err = age.Decrypt(bytes.NewReader(ciphertext1), identity2)
+	if err == nil {
 		t.Error("should not decrypt with identity2")
 	}
 
 	// Second ciphertext should only decrypt with second identity
-	if _, err := age.Decrypt(bytes.NewReader(ciphertext2), identity2); err != nil {
+	_, err = age.Decrypt(bytes.NewReader(ciphertext2), identity2)
+	if err != nil {
 		t.Error("failed to decrypt with identity2")
 	}
 
-	if _, err := age.Decrypt(bytes.NewReader(ciphertext2), identity1); err == nil {
+	_, err = age.Decrypt(bytes.NewReader(ciphertext2), identity1)
+	if err == nil {
 		t.Error("should not decrypt with identity1")
 	}
 }