Update golangci-lint to v2.12.2 with canonical config

Bump the golangci-lint Docker image pin in Dockerfile and the
release-archive sha256 pins in script/bootstrap from 2.11.3 to
2.12.2, and replace .golangci.yml with the canonical config. The
canonical config moves lll/funlen/cyclop/dupl settings from the
top-level linters-settings key (ignored by the v2 schema) to
linters.settings, so those thresholds now actually apply.

Fix all findings the newly applied thresholds surfaced:

- lll: wrap or shorten seven over-length lines (struct tag
  comments, test logger construction, a func signature, and a
  nosec comment)
- goconst: use http.MethodPost/http.MethodPut and new shared
  constants for repeated test strings; add tmplKeyError and
  tmplKeyWebhook constants for template data keys in handlers
- dupl: merge buildHTTPTargetConfig and buildSlackTargetConfig
  into a parameterized buildURLTargetConfig; drop the duplicate
  iWebhookDB test helper in favor of testWebhookDB; extract
  shared helpers in middleware and session tests

internal/handlers/source_management.go

@@ -107,7 +107,7 @@ func (h *Handlers) buildWebhookListItems(
 func (h *Handlers) HandleSourceCreate() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		data := map[string]any{
-			"Error": "",
+			tmplKeyError: "",
 		}
 
 		h.renderTemplate(w, r, "sources_new.html", data)
@@ -146,7 +146,7 @@ func (h *Handlers) HandleSourceCreateSubmit() http.HandlerFunc {
 
 		if name == "" {
 			data := map[string]any{
-				"Error": "Name is required",
+				tmplKeyError: "Name is required",
 			}
 
 			w.WriteHeader(http.StatusBadRequest)
@@ -316,11 +316,11 @@ func (h *Handlers) renderSourceDetail(
 	}
 
 	data := map[string]any{
-		"Webhook":     webhook,
-		"Entrypoints": entrypoints,
-		"Targets":     targets,
-		"Events":      events,
-		"BaseURL":     scheme + "://" + host,
+		tmplKeyWebhook: webhook,
+		"Entrypoints":  entrypoints,
+		"Targets":      targets,
+		"Events":       events,
+		"BaseURL":      scheme + "://" + host,
 	}
 
 	h.renderTemplate(w, r, "source_detail.html", data)
@@ -352,8 +352,8 @@ func (h *Handlers) HandleSourceEdit() http.HandlerFunc {
 		}
 
 		data := map[string]any{
-			"Webhook": webhook,
-			"Error":   "",
+			tmplKeyWebhook: webhook,
+			tmplKeyError:   "",
 		}
 
 		h.renderTemplate(w, r, "source_edit.html", data)
@@ -416,8 +416,8 @@ func (h *Handlers) applyWebhookEdit(
 	name := r.FormValue("name")
 	if name == "" {
 		data := map[string]any{
-			"Webhook": *webhook,
-			"Error":   "Name is required",
+			tmplKeyWebhook: *webhook,
+			tmplKeyError:   "Name is required",
 		}
 
 		w.WriteHeader(http.StatusBadRequest)
@@ -590,15 +590,15 @@ func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
 		}
 
 		data := map[string]any{
-			"Webhook":     webhook,
-			"Events":      evts,
-			"Page":        page,
-			"TotalPages":  totalPages,
-			"TotalEvents": total,
-			"HasPrev":     page > 1,
-			"HasNext":     page < totalPages,
-			"PrevPage":    page - 1,
-			"NextPage":    page + 1,
+			tmplKeyWebhook: webhook,
+			"Events":       evts,
+			"Page":         page,
+			"TotalPages":   totalPages,
+			"TotalEvents":  total,
+			"HasPrev":      page > 1,
+			"HasNext":      page < totalPages,
+			"PrevPage":     page - 1,
+			"NextPage":     page + 1,
 		}
 
 		h.renderTemplate(w, r, "source_logs.html", data)
@@ -904,9 +904,15 @@ func (h *Handlers) buildTargetConfig(
 ) (string, error) {
 	switch targetType {
 	case database.TargetTypeHTTP:
-		return h.buildHTTPTargetConfig(w, r, targetURL)
+		return h.buildURLTargetConfig(
+			w, r, targetURL, "url",
+			"URL is required for HTTP targets",
+		)
 	case database.TargetTypeSlack:
-		return h.buildSlackTargetConfig(w, r, targetURL)
+		return h.buildURLTargetConfig(
+			w, r, targetURL, "webhookUrl",
+			"Webhook URL is required for Slack targets",
+		)
 	case database.TargetTypeDatabase:
 		return h.buildDatabaseTargetConfig(w, expiry)
 	case database.TargetTypeLog:
@@ -921,16 +927,18 @@ func (h *Handlers) buildTargetConfig(
 	}
 }
 
-// buildHTTPTargetConfig builds config JSON for an HTTP target.
-func (h *Handlers) buildHTTPTargetConfig(
+// buildURLTargetConfig builds config JSON for a target whose
+// configuration is a single SSRF-validated URL stored under
+// configKey. missingMsg is the error shown when no URL is given.
+func (h *Handlers) buildURLTargetConfig(
 	w http.ResponseWriter,
 	r *http.Request,
-	targetURL string,
+	targetURL, configKey, missingMsg string,
 ) (string, error) {
 	if targetURL == "" {
 		http.Error(
 			w,
-			"URL is required for HTTP targets",
+			missingMsg,
 			http.StatusBadRequest,
 		)
 
@@ -955,56 +963,7 @@ func (h *Handlers) buildHTTPTargetConfig(
 		return "", err
 	}
 
-	cfg := map[string]any{"url": targetURL}
-
-	configBytes, err := json.Marshal(cfg)
-	if err != nil {
-		http.Error(
-			w, "Internal server error",
-			http.StatusInternalServerError,
-		)
-
-		return "", err
-	}
-
-	return string(configBytes), nil
-}
-
-// buildSlackTargetConfig builds config JSON for a Slack target.
-func (h *Handlers) buildSlackTargetConfig(
-	w http.ResponseWriter,
-	r *http.Request,
-	targetURL string,
-) (string, error) {
-	if targetURL == "" {
-		http.Error(
-			w,
-			"Webhook URL is required for Slack targets",
-			http.StatusBadRequest,
-		)
-
-		return "", errMissingURL
-	}
-
-	err := delivery.ValidateTargetURL(
-		r.Context(), targetURL,
-	)
-	if err != nil {
-		h.log.Warn(
-			"target URL blocked by SSRF protection",
-			"url", targetURL,
-			"error", err,
-		)
-		http.Error(
-			w,
-			"Invalid target URL: "+err.Error(),
-			http.StatusBadRequest,
-		)
-
-		return "", err
-	}
-
-	cfg := map[string]any{"webhookUrl": targetURL}
+	cfg := map[string]any{configKey: targetURL}
 
 	configBytes, err := json.Marshal(cfg)
 	if err != nil {