Update golangci-lint to v2.12.2 with canonical config (#62)

Updates golangci-lint to v2.12.2 everywhere it is pinned and installs the canonical `.golangci.yml`, then remediates every finding the new linter/config surfaces so `make check` is green.

## Version bump

- `Dockerfile` lint stage: `golangci/golangci-lint:v2.11.3-alpine` -> `v2.12.2-alpine` (digest-pinned, date comment updated)
- `Makefile` `deps` target: `go install` moved from the old v1 module path at `@latest` to the pinned `github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2`
- `.golangci.yml` replaced with the canonical config (v2 schema; settings under `linters.settings` so the thresholds actually apply; `default: all` with the standard six disables)
- `script/bootstrap` installs golangci-lint via the system package manager and carries no version pin, so it is unchanged
- CI (`.gitea/workflows/check.yml`) only runs `script/cibuild`, so it needed no change

## Lint remediation

The canonical config surfaced ~3,300 findings across 56k lines. All are fixed, behavior-preserving; incorporates and supersedes the per-package mechanical passes already merged to `main` (refs #61). Highlights:

- `err113`: dynamic errors replaced with package sentinels + `%w` wrapping; comparisons via `errors.Is`
- `goprintffuncname`: printf-style helpers renamed with an `f` suffix (`ui.Writer` message methods, `cli.ReportErrorf`, `database.Fatalf`) and all call sites updated
- `revive` stutter renames: `blob.Handler`, `blob.WithReader`, `blob.ChunkPosition`, `storage.URL`, `storage.Info`; missing doc comments added
- `contextcheck`/`noctx`: `context.Context` threaded through `blob.Packer` and the scanner call sites; context-aware `exec`/`sql` variants
- `funlen`/`cyclop`/`gocognit`/`dupl`: oversized and duplicated functions split into focused helpers (production and test code)
- tests: `t.Parallel()` added where safe (global logger init kept in the serial phase for `-race`), `t.TempDir()`/`t.Helper()` adopted, several suites converted to external test packages
- `gosec`: bounded integer conversions, `ReadHeaderTimeout` on the test HTTP server; remaining warnings suppressed per-site with justifications
- remaining `nolint` directives are rare, targeted, and each carries a reason (e.g. `nilnil` not-found contract in the repository layer, fx module globals, on-disk snake_case struct tags)
- removed the deprecated `log.LogOptions` alias (callers migrated to `log.Options`)

`make check` (tests with `-race`, lint, fmt-check) passes.

Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #62
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/cli/remote.go

@@ -11,6 +11,10 @@ import (
 	"sneak.berlin/go/vaultik/internal/vaultik"
 )
 
+// errNukeNeedsForce guards the destructive 'remote nuke' subcommand.
+var errNukeNeedsForce = errors.New(
+	"remote nuke requires --force (this deletes ALL remote snapshots and blobs)")
+
 // NewRemoteCommand creates the remote command and subcommands
 func NewRemoteCommand() *cobra.Command {
 	cmd := &cobra.Command{
@@ -39,61 +43,20 @@ empty and the next backup starts from scratch.
 
 This is destructive and irreversible. Requires --force.`,
 		Args: cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(cmd *cobra.Command, _ []string) error {
 			if !force {
-				return errors.New("remote nuke requires --force (this deletes ALL remote snapshots and blobs)")
+				return errNukeNeedsForce
 			}
 
-			configPath, err := ResolveConfigPath()
-			if err != nil {
-				return err
-			}
-
-			rootFlags := GetRootFlags()
-
-			return RunWithApp(cmd.Context(), AppOptions{
-				ConfigPath: configPath,
-				LogOptions: log.LogOptions{
-					Verbose: rootFlags.Verbose,
-					Debug:   rootFlags.Debug,
-					Quiet:   rootFlags.Quiet,
-				},
-				Modules: []fx.Option{},
-				Invokes: []fx.Option{
-					fx.Invoke(func(v *vaultik.Vaultik, lc fx.Lifecycle) {
-						lc.Append(fx.Hook{
-							OnStart: func(ctx context.Context) error {
-								go func() {
-									err := v.NukeRemote(true)
-									if err != nil {
-										if !errors.Is(err, context.Canceled) {
-											log.Error("Remote nuke failed", "error", err)
-											ReportError("Remote nuke failed: %v", err)
-											os.Exit(1)
-										}
-									}
-
-									err = v.Shutdowner.Shutdown()
-									if err != nil {
-										log.Error("Failed to shutdown", "error", err)
-									}
-								}()
-
-								return nil
-							},
-							OnStop: func(ctx context.Context) error {
-								v.Cancel()
-
-								return nil
-							},
-						})
-					}),
-				},
-			})
+			return runVaultikApp(cmd, false, false, "Remote nuke failed",
+				func(v *vaultik.Vaultik) error {
+					return v.NukeRemote(true)
+				})
 		},
 	}
 
-	cmd.Flags().BoolVar(&force, "force", false, "Required: confirm destruction of ALL remote data")
+	cmd.Flags().BoolVar(&force, "force", false,
+		"Required: confirm destruction of ALL remote data")
 
 	return cmd
 }
@@ -111,7 +74,7 @@ func newRemoteInfoCommand() *cobra.Command {
 - Count and size of referenced blobs (from all manifests)
 - Count and size of orphaned blobs (not referenced by any manifest)`,
 		Args: cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(cmd *cobra.Command, _ []string) error {
 			// Use unified config resolution
 			configPath, err := ResolveConfigPath()
 			if err != nil {
@@ -122,7 +85,7 @@ func newRemoteInfoCommand() *cobra.Command {
 
 			return RunWithApp(cmd.Context(), AppOptions{
 				ConfigPath: configPath,
-				LogOptions: log.LogOptions{
+				LogOptions: log.Options{
 					Verbose: rootFlags.Verbose,
 					Debug:   rootFlags.Debug,
 					Quiet:   rootFlags.Quiet || jsonOutput,
@@ -131,14 +94,14 @@ func newRemoteInfoCommand() *cobra.Command {
 				Invokes: []fx.Option{
 					fx.Invoke(func(v *vaultik.Vaultik, lc fx.Lifecycle) {
 						lc.Append(fx.Hook{
-							OnStart: func(ctx context.Context) error {
+							OnStart: func(_ context.Context) error {
 								go func() {
 									err := v.RemoteInfo(jsonOutput)
 									if err != nil {
 										if !errors.Is(err, context.Canceled) {
 											if !jsonOutput {
 												log.Error("Failed to get remote info", "error", err)
-												ReportError("Failed to get remote info: %v", err)
+												ReportErrorf("Failed to get remote info: %v", err)
 											}
 
 											os.Exit(1)
@@ -153,7 +116,7 @@ func newRemoteInfoCommand() *cobra.Command {
 
 								return nil
 							},
-							OnStop: func(ctx context.Context) error {
+							OnStop: func(_ context.Context) error {
 								v.Cancel()
 
 								return nil