Update golangci-lint to v2.12.2 with canonical config (#62)

Updates golangci-lint to v2.12.2 everywhere it is pinned and installs the canonical `.golangci.yml`, then remediates every finding the new linter/config surfaces so `make check` is green.

## Version bump

- `Dockerfile` lint stage: `golangci/golangci-lint:v2.11.3-alpine` -> `v2.12.2-alpine` (digest-pinned, date comment updated)
- `Makefile` `deps` target: `go install` moved from the old v1 module path at `@latest` to the pinned `github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2`
- `.golangci.yml` replaced with the canonical config (v2 schema; settings under `linters.settings` so the thresholds actually apply; `default: all` with the standard six disables)
- `script/bootstrap` installs golangci-lint via the system package manager and carries no version pin, so it is unchanged
- CI (`.gitea/workflows/check.yml`) only runs `script/cibuild`, so it needed no change

## Lint remediation

The canonical config surfaced ~3,300 findings across 56k lines. All are fixed, behavior-preserving; incorporates and supersedes the per-package mechanical passes already merged to `main` (refs #61). Highlights:

- `err113`: dynamic errors replaced with package sentinels + `%w` wrapping; comparisons via `errors.Is`
- `goprintffuncname`: printf-style helpers renamed with an `f` suffix (`ui.Writer` message methods, `cli.ReportErrorf`, `database.Fatalf`) and all call sites updated
- `revive` stutter renames: `blob.Handler`, `blob.WithReader`, `blob.ChunkPosition`, `storage.URL`, `storage.Info`; missing doc comments added
- `contextcheck`/`noctx`: `context.Context` threaded through `blob.Packer` and the scanner call sites; context-aware `exec`/`sql` variants
- `funlen`/`cyclop`/`gocognit`/`dupl`: oversized and duplicated functions split into focused helpers (production and test code)
- tests: `t.Parallel()` added where safe (global logger init kept in the serial phase for `-race`), `t.TempDir()`/`t.Helper()` adopted, several suites converted to external test packages
- `gosec`: bounded integer conversions, `ReadHeaderTimeout` on the test HTTP server; remaining warnings suppressed per-site with justifications
- remaining `nolint` directives are rare, targeted, and each carries a reason (e.g. `nilnil` not-found contract in the repository layer, fx module globals, on-disk snake_case struct tags)
- removed the deprecated `log.LogOptions` alias (callers migrated to `log.Options`)

`make check` (tests with `-race`, lint, fmt-check) passes.

Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #62
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/database/snapshots_test.go

@@ -1,4 +1,4 @@
-package database
+package database_test
 
 import (
 	"context"
@@ -7,6 +7,7 @@ import (
 	"testing"
 	"time"
 
+	"sneak.berlin/go/vaultik/internal/database"
 	"sneak.berlin/go/vaultik/internal/types"
 )
 
@@ -21,17 +22,19 @@ const (
 )
 
 func TestSnapshotRepository(t *testing.T) {
+	t.Parallel()
+
 	db, cleanup := setupTestDB(t)
 	defer cleanup()
 
 	ctx := context.Background()
-	repo := NewSnapshotRepository(db)
+	repo := database.NewSnapshotRepository(db)
 
 	// Test Create
-	snapshot := &Snapshot{
+	snapshot := &database.Snapshot{
 		ID:               "2024-01-01T12:00:00Z",
-		Hostname:         "test-host",
-		VaultikVersion:   "1.0.0",
+		Hostname:         testHostname,
+		VaultikVersion:   testVersion,
 		StartedAt:        time.Now().Truncate(time.Second),
 		CompletedAt:      nil,
 		FileCount:        100,
@@ -62,20 +65,52 @@ func TestSnapshotRepository(t *testing.T) {
 	}
 
 	if retrieved.Hostname != snapshot.Hostname {
-		t.Errorf("hostname mismatch: got %s, want %s", retrieved.Hostname, snapshot.Hostname)
+		t.Errorf("hostname mismatch: got %s, want %s",
+			retrieved.Hostname, snapshot.Hostname)
 	}
 
 	if retrieved.FileCount != snapshot.FileCount {
-		t.Errorf("file count mismatch: got %d, want %d", retrieved.FileCount, snapshot.FileCount)
+		t.Errorf("file count mismatch: got %d, want %d",
+			retrieved.FileCount, snapshot.FileCount)
+	}
+}
+
+func TestSnapshotRepositoryUpdateCounts(t *testing.T) {
+	t.Parallel()
+
+	db, cleanup := setupTestDB(t)
+	defer cleanup()
+
+	ctx := context.Background()
+	repo := database.NewSnapshotRepository(db)
+
+	snapshot := &database.Snapshot{
+		ID:               "2024-01-02T12:00:00Z",
+		Hostname:         testHostname,
+		VaultikVersion:   testVersion,
+		StartedAt:        time.Now().Truncate(time.Second),
+		CompletedAt:      nil,
+		FileCount:        100,
+		ChunkCount:       500,
+		BlobCount:        10,
+		TotalSize:        oneHundredMebibytes,
+		BlobSize:         fortyMebibytes,
+		CompressionRatio: compressionRatioPoint4,
+	}
+
+	err := repo.Create(ctx, nil, snapshot)
+	if err != nil {
+		t.Fatalf("failed to create snapshot: %v", err)
 	}
 
 	// Test UpdateCounts
-	err = repo.UpdateCounts(ctx, nil, snapshot.ID.String(), 200, 1000, 20, twoHundredMebibytes, sixtyMebibytes)
+	err = repo.UpdateCounts(ctx, nil, snapshot.ID.String(),
+		200, 1000, 20, twoHundredMebibytes, sixtyMebibytes)
 	if err != nil {
 		t.Fatalf("failed to update counts: %v", err)
 	}
 
-	retrieved, err = repo.GetByID(ctx, snapshot.ID.String())
+	retrieved, err := repo.GetByID(ctx, snapshot.ID.String())
 	if err != nil {
 		t.Fatalf("failed to get updated snapshot: %v", err)
 	}
@@ -85,7 +120,8 @@ func TestSnapshotRepository(t *testing.T) {
 	}
 
 	if retrieved.ChunkCount != 1000 {
-		t.Errorf("chunk count not updated: got %d, want %d", retrieved.ChunkCount, 1000)
+		t.Errorf("chunk count not updated: got %d, want %d",
+			retrieved.ChunkCount, 1000)
 	}
 
 	if retrieved.BlobCount != 20 {
@@ -93,25 +129,37 @@ func TestSnapshotRepository(t *testing.T) {
 	}
 
 	if retrieved.TotalSize != twoHundredMebibytes {
-		t.Errorf("total size not updated: got %d, want %d", retrieved.TotalSize, twoHundredMebibytes)
+		t.Errorf("total size not updated: got %d, want %d",
+			retrieved.TotalSize, twoHundredMebibytes)
 	}
 
 	if retrieved.BlobSize != sixtyMebibytes {
-		t.Errorf("blob size not updated: got %d, want %d", retrieved.BlobSize, sixtyMebibytes)
+		t.Errorf("blob size not updated: got %d, want %d",
+			retrieved.BlobSize, sixtyMebibytes)
 	}
 
 	expectedRatio := compressionRatioPoint3 // 0.3
 	if math.Abs(retrieved.CompressionRatio-expectedRatio) > 0.001 {
-		t.Errorf("compression ratio not updated: got %f, want %f", retrieved.CompressionRatio, expectedRatio)
+		t.Errorf("compression ratio not updated: got %f, want %f",
+			retrieved.CompressionRatio, expectedRatio)
 	}
+}
 
-	// Test ListRecent
-	// Add more snapshots
-	for i := 2; i <= 5; i++ {
-		s := &Snapshot{
+func TestSnapshotRepositoryListRecent(t *testing.T) {
+	t.Parallel()
+
+	db, cleanup := setupTestDB(t)
+	defer cleanup()
+
+	ctx := context.Background()
+	repo := database.NewSnapshotRepository(db)
+
+	// Add snapshots
+	for i := 1; i <= 5; i++ {
+		s := &database.Snapshot{
 			ID:             types.SnapshotID(fmt.Sprintf("2024-01-0%dT12:00:00Z", i)),
-			Hostname:       "test-host",
-			VaultikVersion: "1.0.0",
+			Hostname:       testHostname,
+			VaultikVersion: testVersion,
 			StartedAt:      time.Now().Add(time.Duration(i) * time.Hour).Truncate(time.Second),
 			CompletedAt:    nil,
 			FileCount:      int64(100 * i),
@@ -144,11 +192,13 @@ func TestSnapshotRepository(t *testing.T) {
 }
 
 func TestSnapshotRepositoryNotFound(t *testing.T) {
+	t.Parallel()
+
 	db, cleanup := setupTestDB(t)
 	defer cleanup()
 
 	ctx := context.Background()
-	repo := NewSnapshotRepository(db)
+	repo := database.NewSnapshotRepository(db)
 
 	// Test GetByID with non-existent ID
 	snapshot, err := repo.GetByID(ctx, "nonexistent")
@@ -161,7 +211,8 @@ func TestSnapshotRepositoryNotFound(t *testing.T) {
 	}
 
 	// Test UpdateCounts on non-existent snapshot
-	err = repo.UpdateCounts(ctx, nil, "nonexistent", 100, 200, 10, oneHundredMebibytes, fortyMebibytes)
+	err = repo.UpdateCounts(ctx, nil, "nonexistent",
+		100, 200, 10, oneHundredMebibytes, fortyMebibytes)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -169,16 +220,18 @@ func TestSnapshotRepositoryNotFound(t *testing.T) {
 }
 
 func TestSnapshotRepositoryDuplicate(t *testing.T) {
+	t.Parallel()
+
 	db, cleanup := setupTestDB(t)
 	defer cleanup()
 
 	ctx := context.Background()
-	repo := NewSnapshotRepository(db)
+	repo := database.NewSnapshotRepository(db)
 
-	snapshot := &Snapshot{
+	snapshot := &database.Snapshot{
 		ID:             "2024-01-01T12:00:00Z",
-		Hostname:       "test-host",
-		VaultikVersion: "1.0.0",
+		Hostname:       testHostname,
+		VaultikVersion: testVersion,
 		StartedAt:      time.Now().Truncate(time.Second),
 		CompletedAt:    nil,
 		FileCount:      100,