refactor: use pinned golangci-lint Docker image for linting

Refactor Dockerfile to use a separate lint stage with a pinned
golangci-lint v2.11.3 Docker image instead of installing
golangci-lint via curl in the builder stage. This follows the
pattern used by sneak/pixa.

Changes:
- Dockerfile: separate lint stage using golangci/golangci-lint:v2.11.3
  (Debian-based, pinned by sha256) with COPY --from=lint dependency
- Bump Go from 1.24 to 1.26.1 (golang:1.26.1-bookworm, pinned)
- Bump golangci-lint from v1.64.8 to v2.11.3
- Migrate .golangci.yml from v1 to v2 format (same linters, format only)
- All Docker images pinned by sha256 digest
- Fix all lint issues from the v2 linter upgrade:
  - Add package comments to all packages
  - Add doc comments to all exported types, functions, and methods
  - Fix unchecked errors (errcheck)
  - Fix unused parameters (revive)
  - Fix gosec warnings (MaxBytesReader for form parsing)
  - Fix staticcheck suggestions (fmt.Fprintf instead of WriteString)
  - Rename DeliveryTask to Task to avoid stutter (delivery.Task)
  - Rename shadowed builtin 'max' parameter
- Update README.md version requirements

internal/healthcheck/healthcheck.go

@@ -1,3 +1,4 @@
+// Package healthcheck provides application health status reporting.
 package healthcheck
 
 import (
@@ -12,7 +13,7 @@ import (
 	"sneak.berlin/go/webhooker/internal/logger"
 )
 
-// nolint:revive // HealthcheckParams is a standard fx naming convention
+//nolint:revive // HealthcheckParams is a standard fx naming convention.
 type HealthcheckParams struct {
 	fx.In
 	Globals  *globals.Globals
@@ -21,30 +22,33 @@ type HealthcheckParams struct {
 	Database *database.Database
 }
 
+// Healthcheck tracks application uptime and reports health status.
 type Healthcheck struct {
 	StartupTime time.Time
 	log         *slog.Logger
 	params      *HealthcheckParams
 }
 
+// New creates a Healthcheck that records the startup time on fx start.
 func New(lc fx.Lifecycle, params HealthcheckParams) (*Healthcheck, error) {
 	s := new(Healthcheck)
 	s.params = &params
 	s.log = params.Logger.Get()
 
 	lc.Append(fx.Hook{
-		OnStart: func(_ context.Context) error { // nolint:revive // ctx unused but required by fx
+		//nolint:revive // ctx unused but required by fx.
+		OnStart: func(_ context.Context) error {
 			s.StartupTime = time.Now()
 			return nil
 		},
-		OnStop: func(ctx context.Context) error {
+		OnStop: func(_ context.Context) error {
 			return nil
 		},
 	})
 	return s, nil
 }
 
-// nolint:revive // HealthcheckResponse is a clear, descriptive name
+//nolint:revive // HealthcheckResponse is a clear, descriptive name.
 type HealthcheckResponse struct {
 	Status        string `json:"status"`
 	Now           string `json:"now"`
@@ -59,6 +63,7 @@ func (s *Healthcheck) uptime() time.Duration {
 	return time.Since(s.StartupTime)
 }
 
+// Healthcheck returns the current health status of the application.
 func (s *Healthcheck) Healthcheck() *HealthcheckResponse {
 	resp := &HealthcheckResponse{
 		Status:        "ok",