refactor: use pinned golangci-lint Docker image for linting

Refactor Dockerfile to use a separate lint stage with a pinned
golangci-lint v2.11.3 Docker image instead of installing
golangci-lint via curl in the builder stage. This follows the
pattern used by sneak/pixa.

Changes:
- Dockerfile: separate lint stage using golangci/golangci-lint:v2.11.3
  (Debian-based, pinned by sha256) with COPY --from=lint dependency
- Bump Go from 1.24 to 1.26.1 (golang:1.26.1-bookworm, pinned)
- Bump golangci-lint from v1.64.8 to v2.11.3
- Migrate .golangci.yml from v1 to v2 format (same linters, format only)
- All Docker images pinned by sha256 digest
- Fix all lint issues from the v2 linter upgrade:
  - Add package comments to all packages
  - Add doc comments to all exported types, functions, and methods
  - Fix unchecked errors (errcheck)
  - Fix unused parameters (revive)
  - Fix gosec warnings (MaxBytesReader for form parsing)
  - Fix staticcheck suggestions (fmt.Fprintf instead of WriteString)
  - Rename DeliveryTask to Task to avoid stutter (delivery.Task)
  - Rename shadowed builtin 'max' parameter
- Update README.md version requirements

internal/middleware/middleware.go

@@ -1,3 +1,5 @@
+// Package middleware provides HTTP middleware for logging, auth,
+// CORS, and metrics.
 package middleware
 
 import (
@@ -19,26 +21,42 @@ import (
 	"sneak.berlin/go/webhooker/internal/session"
 )
 
-// nolint:revive // MiddlewareParams is a standard fx naming convention
+const (
+	// corsMaxAge is the maximum time (in seconds) that a
+	// preflight response can be cached.
+	corsMaxAge = 300
+)
+
+//nolint:revive // MiddlewareParams is a standard fx naming convention.
 type MiddlewareParams struct {
 	fx.In
+
 	Logger  *logger.Logger
 	Globals *globals.Globals
 	Config  *config.Config
 	Session *session.Session
 }
 
+// Middleware provides HTTP middleware for logging, CORS, auth, and
+// metrics.
 type Middleware struct {
 	log     *slog.Logger
 	params  *MiddlewareParams
 	session *session.Session
 }
 
-func New(lc fx.Lifecycle, params MiddlewareParams) (*Middleware, error) {
+// New creates a Middleware from the provided fx parameters.
+//
+//nolint:revive // lc parameter is required by fx even if unused.
+func New(
+	lc fx.Lifecycle,
+	params MiddlewareParams,
+) (*Middleware, error) {
 	s := new(Middleware)
 	s.params = &params
 	s.log = params.Logger.Get()
 	s.session = params.Session
+
 	return s, nil
 }
 
@@ -50,19 +68,24 @@ func ipFromHostPort(hp string) string {
 	if err != nil {
 		return ""
 	}
+
 	if len(h) > 0 && h[0] == '[' {
 		return h[1 : len(h)-1]
 	}
+
 	return h
 }
 
 type loggingResponseWriter struct {
 	http.ResponseWriter
+
 	statusCode int
 }
 
-// nolint:revive // unexported type is only used internally
-func NewLoggingResponseWriter(w http.ResponseWriter) *loggingResponseWriter {
+// newLoggingResponseWriter wraps w and records status codes.
+func newLoggingResponseWriter(
+	w http.ResponseWriter,
+) *loggingResponseWriter {
 	return &loggingResponseWriter{w, http.StatusOK}
 }
 
@@ -71,23 +94,30 @@ func (lrw *loggingResponseWriter) WriteHeader(code int) {
 	lrw.ResponseWriter.WriteHeader(code)
 }
 
-// type Middleware func(http.Handler) http.Handler
-// this returns a Middleware that is designed to do every request through the
-// mux, note the signature:
+// Logging returns middleware that logs each HTTP request with
+// timing and metadata.
 func (s *Middleware) Logging() func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		return http.HandlerFunc(func(
+			w http.ResponseWriter,
+			r *http.Request,
+		) {
 			start := time.Now()
-			lrw := NewLoggingResponseWriter(w)
+			lrw := newLoggingResponseWriter(w)
 			ctx := r.Context()
+
 			defer func() {
 				latency := time.Since(start)
 				requestID := ""
-				if reqID := ctx.Value(middleware.RequestIDKey); reqID != nil {
+
+				if reqID := ctx.Value(
+					middleware.RequestIDKey,
+				); reqID != nil {
 					if id, ok := reqID.(string); ok {
 						requestID = id
 					}
 				}
+
 				s.log.Info("http request",
 					"request_start", start,
 					"method", r.Method,
@@ -107,20 +137,29 @@ func (s *Middleware) Logging() func(http.Handler) http.Handler {
 	}
 }
 
+// CORS returns middleware that sets CORS headers (permissive in
+// dev, no-op in prod).
 func (s *Middleware) CORS() func(http.Handler) http.Handler {
 	if s.params.Config.IsDev() {
 		// In development, allow any origin for local testing.
 		return cors.Handler(cors.Options{
-			AllowedOrigins:   []string{"*"},
-			AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
-			AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token"},
+			AllowedOrigins: []string{"*"},
+			AllowedMethods: []string{
+				"GET", "POST", "PUT", "DELETE", "OPTIONS",
+			},
+			AllowedHeaders: []string{
+				"Accept", "Authorization",
+				"Content-Type", "X-CSRF-Token",
+			},
 			ExposedHeaders:   []string{"Link"},
 			AllowCredentials: false,
-			MaxAge:           300,
+			MaxAge:           corsMaxAge,
 		})
 	}
-	// In production, the web UI is server-rendered so cross-origin
-	// requests are not expected. Return a no-op middleware.
+
+	// In production, the web UI is server-rendered so
+	// cross-origin requests are not expected. Return a no-op
+	// middleware.
 	return func(next http.Handler) http.Handler {
 		return next
 	}
@@ -130,20 +169,33 @@ func (s *Middleware) CORS() func(http.Handler) http.Handler {
 // Unauthenticated users are redirected to the login page.
 func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		return http.HandlerFunc(func(
+			w http.ResponseWriter,
+			r *http.Request,
+		) {
 			sess, err := s.session.Get(r)
 			if err != nil {
-				s.log.Debug("auth middleware: failed to get session", "error", err)
-				http.Redirect(w, r, "/pages/login", http.StatusSeeOther)
+				s.log.Debug(
+					"auth middleware: failed to get session",
+					"error", err,
+				)
+				http.Redirect(
+					w, r, "/pages/login", http.StatusSeeOther,
+				)
+
 				return
 			}
 
 			if !s.session.IsAuthenticated(sess) {
-				s.log.Debug("auth middleware: unauthenticated request",
+				s.log.Debug(
+					"auth middleware: unauthenticated request",
 					"path", r.URL.Path,
 					"method", r.Method,
 				)
-				http.Redirect(w, r, "/pages/login", http.StatusSeeOther)
+				http.Redirect(
+					w, r, "/pages/login", http.StatusSeeOther,
+				)
+
 				return
 			}
 
@@ -152,15 +204,19 @@ func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
 	}
 }
 
+// Metrics returns middleware that records Prometheus HTTP metrics.
 func (s *Middleware) Metrics() func(http.Handler) http.Handler {
 	mdlw := ghmm.New(ghmm.Config{
 		Recorder: metrics.NewRecorder(metrics.Config{}),
 	})
+
 	return func(next http.Handler) http.Handler {
 		return std.Handler("", mdlw, next)
 	}
 }
 
+// MetricsAuth returns middleware that protects metrics endpoints
+// with basic auth.
 func (s *Middleware) MetricsAuth() func(http.Handler) http.Handler {
 	return basicauth.New(
 		"metrics",
@@ -172,33 +228,63 @@ func (s *Middleware) MetricsAuth() func(http.Handler) http.Handler {
 	)
 }
 
-// SecurityHeaders returns middleware that sets production security headers
-// on every response: HSTS, X-Content-Type-Options, X-Frame-Options, CSP,
-// Referrer-Policy, and Permissions-Policy.
+// SecurityHeaders returns middleware that sets production security
+// headers on every response: HSTS, X-Content-Type-Options,
+// X-Frame-Options, CSP, Referrer-Policy, and Permissions-Policy.
 func (s *Middleware) SecurityHeaders() func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			w.Header().Set("Strict-Transport-Security", "max-age=63072000; includeSubDomains; preload")
-			w.Header().Set("X-Content-Type-Options", "nosniff")
+		return http.HandlerFunc(func(
+			w http.ResponseWriter,
+			r *http.Request,
+		) {
+			w.Header().Set(
+				"Strict-Transport-Security",
+				"max-age=63072000; includeSubDomains; preload",
+			)
+			w.Header().Set(
+				"X-Content-Type-Options", "nosniff",
+			)
 			w.Header().Set("X-Frame-Options", "DENY")
-			w.Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'")
-			w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
-			w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=()")
+			w.Header().Set(
+				"Content-Security-Policy",
+				"default-src 'self'; "+
+					"script-src 'self' 'unsafe-inline'; "+
+					"style-src 'self' 'unsafe-inline'",
+			)
+			w.Header().Set(
+				"Referrer-Policy",
+				"strict-origin-when-cross-origin",
+			)
+			w.Header().Set(
+				"Permissions-Policy",
+				"camera=(), microphone=(), geolocation=()",
+			)
+
 			next.ServeHTTP(w, r)
 		})
 	}
 }
 
-// MaxBodySize returns middleware that limits the request body size for POST
-// requests. If the body exceeds the given limit in bytes, the server returns
-// 413 Request Entity Too Large. This prevents clients from sending arbitrarily
-// large form bodies.
-func (s *Middleware) MaxBodySize(maxBytes int64) func(http.Handler) http.Handler {
+// MaxBodySize returns middleware that limits the request body size
+// for POST requests. If the body exceeds the given limit in
+// bytes, the server returns 413 Request Entity Too Large. This
+// prevents clients from sending arbitrarily large form bodies.
+func (s *Middleware) MaxBodySize(
+	maxBytes int64,
+) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			if r.Method == http.MethodPost || r.Method == http.MethodPut || r.Method == http.MethodPatch {
-				r.Body = http.MaxBytesReader(w, r.Body, maxBytes)
+		return http.HandlerFunc(func(
+			w http.ResponseWriter,
+			r *http.Request,
+		) {
+			if r.Method == http.MethodPost ||
+				r.Method == http.MethodPut ||
+				r.Method == http.MethodPatch {
+				r.Body = http.MaxBytesReader(
+					w, r.Body, maxBytes,
+				)
 			}
+
 			next.ServeHTTP(w, r)
 		})
 	}