refactor: use pinned golangci-lint Docker image for linting

Refactor Dockerfile to use a separate lint stage with a pinned
golangci-lint v2.11.3 Docker image instead of installing
golangci-lint via curl in the builder stage. This follows the
pattern used by sneak/pixa.

Changes:
- Dockerfile: separate lint stage using golangci/golangci-lint:v2.11.3
  (Debian-based, pinned by sha256) with COPY --from=lint dependency
- Bump Go from 1.24 to 1.26.1 (golang:1.26.1-bookworm, pinned)
- Bump golangci-lint from v1.64.8 to v2.11.3
- Migrate .golangci.yml from v1 to v2 format (same linters, format only)
- All Docker images pinned by sha256 digest
- Fix all lint issues from the v2 linter upgrade:
  - Add package comments to all packages
  - Add doc comments to all exported types, functions, and methods
  - Fix unchecked errors (errcheck)
  - Fix unused parameters (revive)
  - Fix gosec warnings (MaxBytesReader for form parsing)
  - Fix staticcheck suggestions (fmt.Fprintf instead of WriteString)
  - Rename DeliveryTask to Task to avoid stutter (delivery.Task)
  - Rename shadowed builtin 'max' parameter
- Update README.md version requirements

internal/database/base_model.go

@@ -16,8 +16,8 @@ type BaseModel struct {
 	DeletedAt gorm.DeletedAt `gorm:"index" json:"deleted_at,omitempty"`
 }
 
-// BeforeCreate hook to set UUID before creating a record
-func (b *BaseModel) BeforeCreate(tx *gorm.DB) error {
+// BeforeCreate hook to set UUID before creating a record.
+func (b *BaseModel) BeforeCreate(_ *gorm.DB) error {
 	if b.ID == "" {
 		b.ID = uuid.New().String()
 	}

internal/database/database.go

@@ -1,3 +1,4 @@
+// Package database provides SQLite persistence for webhooks, events, and users.
 package database
 
 import (
@@ -19,19 +20,21 @@ import (
 	"sneak.berlin/go/webhooker/internal/logger"
 )
 
-// nolint:revive // DatabaseParams is a standard fx naming convention
+//nolint:revive // DatabaseParams is a standard fx naming convention.
 type DatabaseParams struct {
 	fx.In
 	Config *config.Config
 	Logger *logger.Logger
 }
 
+// Database manages the main SQLite connection and schema migrations.
 type Database struct {
 	db     *gorm.DB
 	log    *slog.Logger
 	params *DatabaseParams
 }
 
+// New creates a Database that connects on fx start and disconnects on stop.
 func New(lc fx.Lifecycle, params DatabaseParams) (*Database, error) {
 	d := &Database{
 		params: &params,
@@ -149,6 +152,7 @@ func (d *Database) close() error {
 	return nil
 }
 
+// DB returns the underlying GORM database handle.
 func (d *Database) DB() *gorm.DB {
 	return d.db
 }

internal/database/model_delivery.go

@@ -3,6 +3,7 @@ package database
 // DeliveryStatus represents the status of a delivery
 type DeliveryStatus string
 
+// Delivery status values.
 const (
 	DeliveryStatusPending   DeliveryStatus = "pending"
 	DeliveryStatusDelivered DeliveryStatus = "delivered"

internal/database/model_target.go

@@ -3,6 +3,7 @@ package database
 // TargetType represents the type of delivery target
 type TargetType string
 
+// Target type values.
 const (
 	TargetTypeHTTP     TargetType = "http"
 	TargetTypeDatabase TargetType = "database"

internal/database/password.go

@@ -169,16 +169,16 @@ func GenerateRandomPassword(length int) (string, error) {
 	return string(password), nil
 }
 
-// cryptoRandInt generates a cryptographically secure random integer in [0, max)
-func cryptoRandInt(max int) int {
-	if max <= 0 {
-		panic("max must be positive")
+// cryptoRandInt generates a cryptographically secure random integer in [0, upperBound).
+func cryptoRandInt(upperBound int) int {
+	if upperBound <= 0 {
+		panic("upperBound must be positive")
 	}
 
 	// Calculate the maximum valid value to avoid modulo bias
-	// For example, if max=200 and we have 256 possible values,
+	// For example, if upperBound=200 and we have 256 possible values,
 	// we only accept values 0-199 (reject 200-255)
-	nBig, err := rand.Int(rand.Reader, big.NewInt(int64(max)))
+	nBig, err := rand.Int(rand.Reader, big.NewInt(int64(upperBound)))
 	if err != nil {
 		panic(fmt.Sprintf("crypto/rand error: %v", err))
 	}

internal/database/webhook_db_manager.go

@@ -73,13 +73,13 @@ func (m *WebhookDBManager) openDB(webhookID string) (*gorm.DB, error) {
 		Conn: sqlDB,
 	}, &gorm.Config{})
 	if err != nil {
-		sqlDB.Close()
+		_ = sqlDB.Close()
 		return nil, fmt.Errorf("connecting to webhook database %s: %w", webhookID, err)
 	}
 
 	// Run migrations for event-tier models only
 	if err := db.AutoMigrate(&Event{}, &Delivery{}, &DeliveryResult{}); err != nil {
-		sqlDB.Close()
+		_ = sqlDB.Close()
 		return nil, fmt.Errorf("migrating webhook database %s: %w", webhookID, err)
 	}
 
@@ -111,7 +111,7 @@ func (m *WebhookDBManager) GetDB(webhookID string) (*gorm.DB, error) {
 	if loaded {
 		// Another goroutine created it first; close our duplicate
 		if sqlDB, closeErr := db.DB(); closeErr == nil {
-			sqlDB.Close()
+			_ = sqlDB.Close()
 		}
 		existingDB, castOK := actual.(*gorm.DB)
 		if !castOK {
@@ -143,7 +143,7 @@ func (m *WebhookDBManager) DeleteDB(webhookID string) error {
 	if val, ok := m.dbs.LoadAndDelete(webhookID); ok {
 		if gormDB, castOK := val.(*gorm.DB); castOK {
 			if sqlDB, err := gormDB.DB(); err == nil {
-				sqlDB.Close()
+				_ = sqlDB.Close()
 			}
 		}
 	}