refactor: use pinned golangci-lint Docker image for linting

Refactor Dockerfile to use a separate lint stage with a pinned
golangci-lint v2.11.3 Docker image instead of installing
golangci-lint via curl in the builder stage. This follows the
pattern used by sneak/pixa.

Changes:
- Dockerfile: separate lint stage using golangci/golangci-lint:v2.11.3
  (Debian-based, pinned by sha256) with COPY --from=lint dependency
- Bump Go from 1.24 to 1.26.1 (golang:1.26.1-bookworm, pinned)
- Bump golangci-lint from v1.64.8 to v2.11.3
- Migrate .golangci.yml from v1 to v2 format (same linters, format only)
- All Docker images pinned by sha256 digest
- Fix all lint issues from the v2 linter upgrade:
  - Add package comments to all packages
  - Add doc comments to all exported types, functions, and methods
  - Fix unchecked errors (errcheck)
  - Fix unused parameters (revive)
  - Fix gosec warnings (MaxBytesReader for form parsing)
  - Fix staticcheck suggestions (fmt.Fprintf instead of WriteString)
  - Rename DeliveryTask to Task to avoid stutter (delivery.Task)
  - Rename shadowed builtin 'max' parameter
- Update README.md version requirements

internal/server/routes.go

@@ -11,15 +11,24 @@ import (
 	"sneak.berlin/go/webhooker/static"
 )
 
-// maxFormBodySize is the maximum allowed request body size (in bytes) for
-// form POST endpoints.  1 MB is generous for any form submission while
-// preventing abuse from oversized payloads.
+// maxFormBodySize is the maximum allowed request body size (in
+// bytes) for form POST endpoints. 1 MB is generous for any form
+// submission while preventing abuse from oversized payloads.
 const maxFormBodySize int64 = 1 * 1024 * 1024 // 1 MB
 
+// requestTimeout is the maximum time allowed for a single HTTP
+// request.
+const requestTimeout = 60 * time.Second
+
+// SetupRoutes configures all HTTP routes and middleware on the
+// server's router.
 func (s *Server) SetupRoutes() {
 	s.router = chi.NewRouter()
+	s.setupGlobalMiddleware()
+	s.setupRoutes()
+}
 
-	// Global middleware stack — applied to every request.
+func (s *Server) setupGlobalMiddleware() {
 	s.router.Use(middleware.Recoverer)
 	s.router.Use(middleware.RequestID)
 	s.router.Use(s.mw.SecurityHeaders())
@@ -31,24 +40,28 @@ func (s *Server) SetupRoutes() {
 	}
 
 	s.router.Use(s.mw.CORS())
-	s.router.Use(middleware.Timeout(60 * time.Second))
+	s.router.Use(middleware.Timeout(requestTimeout))
 
-	// Sentry error reporting (if SENTRY_DSN is set). Repanic is true
-	// so panics still bubble up to the Recoverer middleware above.
+	// Sentry error reporting (if SENTRY_DSN is set). Repanic is
+	// true so panics still bubble up to the Recoverer middleware.
 	if s.sentryEnabled {
 		sentryHandler := sentryhttp.New(sentryhttp.Options{
 			Repanic: true,
 		})
 		s.router.Use(sentryHandler.Handle)
 	}
+}
 
-	// Routes
+func (s *Server) setupRoutes() {
 	s.router.Get("/", s.h.HandleIndex())
 
-	s.router.Mount("/s", http.StripPrefix("/s", http.FileServer(http.FS(static.Static))))
+	s.router.Mount(
+		"/s",
+		http.StripPrefix("/s", http.FileServer(http.FS(static.Static))),
+	)
 
 	s.router.Route("/api/v1", func(_ chi.Router) {
-		// TODO: Add API routes here
+		// API routes will be added here.
 	})
 
 	s.router.Get(
@@ -60,62 +73,89 @@ func (s *Server) SetupRoutes() {
 	if s.params.Config.MetricsUsername != "" {
 		s.router.Group(func(r chi.Router) {
 			r.Use(s.mw.MetricsAuth())
-			r.Get("/metrics", http.HandlerFunc(promhttp.Handler().ServeHTTP))
+			r.Get(
+				"/metrics",
+				http.HandlerFunc(
+					promhttp.Handler().ServeHTTP,
+				),
+			)
 		})
 	}
 
-	// pages that are rendered server-side — CSRF-protected, body-size
-	// limited, and with per-IP rate limiting on the login endpoint.
+	s.setupPageRoutes()
+	s.setupUserRoutes()
+	s.setupSourceRoutes()
+	s.setupWebhookRoutes()
+}
+
+func (s *Server) setupPageRoutes() {
 	s.router.Route("/pages", func(r chi.Router) {
 		r.Use(s.mw.CSRF())
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
 
-		// Login page — rate-limited to prevent brute-force attacks
 		r.Group(func(r chi.Router) {
 			r.Use(s.mw.LoginRateLimit())
 			r.Get("/login", s.h.HandleLoginPage())
 			r.Post("/login", s.h.HandleLoginSubmit())
 		})
 
-		// Logout (auth required)
 		r.Post("/logout", s.h.HandleLogout())
 	})
+}
 
-	// User profile routes
+func (s *Server) setupUserRoutes() {
 	s.router.Route("/user/{username}", func(r chi.Router) {
 		r.Use(s.mw.CSRF())
 		r.Get("/", s.h.HandleProfile())
 	})
+}
 
-	// Webhook management routes (require authentication, CSRF-protected)
+func (s *Server) setupSourceRoutes() {
 	s.router.Route("/sources", func(r chi.Router) {
 		r.Use(s.mw.CSRF())
 		r.Use(s.mw.RequireAuth())
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
-		r.Get("/", s.h.HandleSourceList())             // List all webhooks
-		r.Get("/new", s.h.HandleSourceCreate())        // Show create form
-		r.Post("/new", s.h.HandleSourceCreateSubmit()) // Handle create submission
+		r.Get("/", s.h.HandleSourceList())
+		r.Get("/new", s.h.HandleSourceCreate())
+		r.Post("/new", s.h.HandleSourceCreateSubmit())
 	})
 
 	s.router.Route("/source/{sourceID}", func(r chi.Router) {
 		r.Use(s.mw.CSRF())
 		r.Use(s.mw.RequireAuth())
 		r.Use(s.mw.MaxBodySize(maxFormBodySize))
-		r.Get("/", s.h.HandleSourceDetail())                                       // View webhook details
-		r.Get("/edit", s.h.HandleSourceEdit())                                     // Show edit form
-		r.Post("/edit", s.h.HandleSourceEditSubmit())                              // Handle edit submission
-		r.Post("/delete", s.h.HandleSourceDelete())                                // Delete webhook
-		r.Get("/logs", s.h.HandleSourceLogs())                                     // View webhook logs
-		r.Post("/entrypoints", s.h.HandleEntrypointCreate())                       // Add entrypoint
-		r.Post("/entrypoints/{entrypointID}/delete", s.h.HandleEntrypointDelete()) // Delete entrypoint
-		r.Post("/entrypoints/{entrypointID}/toggle", s.h.HandleEntrypointToggle()) // Toggle entrypoint active
-		r.Post("/targets", s.h.HandleTargetCreate())                               // Add target
-		r.Post("/targets/{targetID}/delete", s.h.HandleTargetDelete())             // Delete target
-		r.Post("/targets/{targetID}/toggle", s.h.HandleTargetToggle())             // Toggle target active
+		r.Get("/", s.h.HandleSourceDetail())
+		r.Get("/edit", s.h.HandleSourceEdit())
+		r.Post("/edit", s.h.HandleSourceEditSubmit())
+		r.Post("/delete", s.h.HandleSourceDelete())
+		r.Get("/logs", s.h.HandleSourceLogs())
+		r.Post(
+			"/entrypoints",
+			s.h.HandleEntrypointCreate(),
+		)
+		r.Post(
+			"/entrypoints/{entrypointID}/delete",
+			s.h.HandleEntrypointDelete(),
+		)
+		r.Post(
+			"/entrypoints/{entrypointID}/toggle",
+			s.h.HandleEntrypointToggle(),
+		)
+		r.Post("/targets", s.h.HandleTargetCreate())
+		r.Post(
+			"/targets/{targetID}/delete",
+			s.h.HandleTargetDelete(),
+		)
+		r.Post(
+			"/targets/{targetID}/toggle",
+			s.h.HandleTargetToggle(),
+		)
 	})
-
-	// Entrypoint endpoint — accepts incoming webhook POST requests only.
-	// Using HandleFunc so the handler itself can return 405 for non-POST
-	// methods (chi's Method routing returns 405 without Allow header).
-	s.router.HandleFunc("/webhook/{uuid}", s.h.HandleWebhook())
+}
+
+func (s *Server) setupWebhookRoutes() {
+	s.router.HandleFunc(
+		"/webhook/{uuid}",
+		s.h.HandleWebhook(),
+	)
 }