refactor: use pinned golangci-lint Docker image for linting

Refactor Dockerfile to use a separate lint stage with a pinned
golangci-lint v2.11.3 Docker image instead of installing
golangci-lint via curl in the builder stage. This follows the
pattern used by sneak/pixa.

Changes:
- Dockerfile: separate lint stage using golangci/golangci-lint:v2.11.3
  (Debian-based, pinned by sha256) with COPY --from=lint dependency
- Bump Go from 1.24 to 1.26.1 (golang:1.26.1-bookworm, pinned)
- Bump golangci-lint from v1.64.8 to v2.11.3
- Migrate .golangci.yml from v1 to v2 format (same linters, format only)
- All Docker images pinned by sha256 digest
- Fix all lint issues from the v2 linter upgrade:
  - Add package comments to all packages
  - Add doc comments to all exported types, functions, and methods
  - Fix unchecked errors (errcheck)
  - Fix unused parameters (revive)
  - Fix gosec warnings (MaxBytesReader for form parsing)
  - Fix staticcheck suggestions (fmt.Fprintf instead of WriteString)
  - Rename DeliveryTask to Task to avoid stutter (delivery.Task)
  - Rename shadowed builtin 'max' parameter
- Update README.md version requirements

internal/middleware/ratelimit.go

@@ -8,40 +8,56 @@ import (
 )
 
 const (
-	// loginRateLimit is the maximum number of login attempts per interval.
+	// loginRateLimit is the maximum number of login attempts
+	// per interval.
 	loginRateLimit = 5
 
 	// loginRateInterval is the time window for the rate limit.
 	loginRateInterval = 1 * time.Minute
 )
 
-// LoginRateLimit returns middleware that enforces per-IP rate limiting
-// on login attempts using go-chi/httprate. Only POST requests are
-// rate-limited; GET requests (rendering the login form) pass through
-// unaffected. When the rate limit is exceeded, a 429 Too Many Requests
-// response is returned. IP extraction honours X-Forwarded-For,
-// X-Real-IP, and True-Client-IP headers for reverse-proxy setups.
+// LoginRateLimit returns middleware that enforces per-IP rate
+// limiting on login attempts using go-chi/httprate. Only POST
+// requests are rate-limited; GET requests (rendering the login
+// form) pass through unaffected. When the rate limit is exceeded,
+// a 429 Too Many Requests response is returned. IP extraction
+// honours X-Forwarded-For, X-Real-IP, and True-Client-IP headers
+// for reverse-proxy setups.
 func (m *Middleware) LoginRateLimit() func(http.Handler) http.Handler {
 	limiter := httprate.Limit(
 		loginRateLimit,
 		loginRateInterval,
 		httprate.WithKeyFuncs(httprate.KeyByRealIP),
-		httprate.WithLimitHandler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			m.log.Warn("login rate limit exceeded",
-				"path", r.URL.Path,
-			)
-			http.Error(w, "Too many login attempts. Please try again later.", http.StatusTooManyRequests)
-		})),
+		httprate.WithLimitHandler(http.HandlerFunc(
+			func(w http.ResponseWriter, r *http.Request) {
+				m.log.Warn("login rate limit exceeded",
+					"path", r.URL.Path,
+				)
+				http.Error(
+					w,
+					"Too many login attempts. "+
+						"Please try again later.",
+					http.StatusTooManyRequests,
+				)
+			},
+		)),
 	)
 
 	return func(next http.Handler) http.Handler {
 		limited := limiter(next)
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			// Only rate-limit POST requests (actual login attempts)
+
+		return http.HandlerFunc(func(
+			w http.ResponseWriter,
+			r *http.Request,
+		) {
+			// Only rate-limit POST requests (actual login
+			// attempts)
 			if r.Method != http.MethodPost {
 				next.ServeHTTP(w, r)
+
 				return
 			}
+
 			limited.ServeHTTP(w, r)
 		})
 	}