refactor: use pinned golangci-lint Docker image for linting

Refactor Dockerfile to use a separate lint stage with a pinned
golangci-lint v2.11.3 Docker image instead of installing
golangci-lint via curl in the builder stage. This follows the
pattern used by sneak/pixa.

Changes:
- Dockerfile: separate lint stage using golangci/golangci-lint:v2.11.3
  (Debian-based, pinned by sha256) with COPY --from=lint dependency
- Bump Go from 1.24 to 1.26.1 (golang:1.26.1-bookworm, pinned)
- Bump golangci-lint from v1.64.8 to v2.11.3
- Migrate .golangci.yml from v1 to v2 format (same linters, format only)
- All Docker images pinned by sha256 digest
- Fix all lint issues from the v2 linter upgrade:
  - Add package comments to all packages
  - Add doc comments to all exported types, functions, and methods
  - Fix unchecked errors (errcheck)
  - Fix unused parameters (revive)
  - Fix gosec warnings (MaxBytesReader for form parsing)
  - Fix staticcheck suggestions (fmt.Fprintf instead of WriteString)
  - Rename DeliveryTask to Task to avoid stutter (delivery.Task)
  - Rename shadowed builtin 'max' parameter
- Update README.md version requirements

internal/server/routes.go

@@ -16,6 +16,7 @@ import (
 // preventing abuse from oversized payloads.
 const maxFormBodySize int64 = 1 * 1024 * 1024 // 1 MB
 
+// SetupRoutes configures all HTTP routes and middleware on the server's router.
 func (s *Server) SetupRoutes() {
 	s.router = chi.NewRouter()
 

internal/server/server.go

@@ -1,3 +1,4 @@
+// Package server wires up HTTP routes and manages the application lifecycle.
 package server
 
 import (
@@ -21,7 +22,7 @@ import (
 	"github.com/go-chi/chi"
 )
 
-// nolint:revive // ServerParams is a standard fx naming convention
+//nolint:revive // ServerParams is a standard fx naming convention.
 type ServerParams struct {
 	fx.In
 	Logger     *logger.Logger
@@ -31,6 +32,7 @@ type ServerParams struct {
 	Handlers   *handlers.Handlers
 }
 
+// Server is the main HTTP server that wires up routes and manages graceful shutdown.
 type Server struct {
 	startupTime   time.Time
 	exitCode      int
@@ -45,6 +47,7 @@ type Server struct {
 	h             *handlers.Handlers
 }
 
+// New creates a Server that starts the HTTP listener on fx start and stops it gracefully.
 func New(lc fx.Lifecycle, params ServerParams) (*Server, error) {
 	s := new(Server)
 	s.params = params
@@ -53,12 +56,12 @@ func New(lc fx.Lifecycle, params ServerParams) (*Server, error) {
 	s.log = params.Logger.Get()
 
 	lc.Append(fx.Hook{
-		OnStart: func(ctx context.Context) error {
+		OnStart: func(_ context.Context) error {
 			s.startupTime = time.Now()
 			go s.Run()
 			return nil
 		},
-		OnStop: func(ctx context.Context) error {
+		OnStop: func(_ context.Context) error {
 			s.cleanShutdown()
 			return nil
 		},
@@ -66,6 +69,7 @@ func New(lc fx.Lifecycle, params ServerParams) (*Server, error) {
 	return s, nil
 }
 
+// Run configures Sentry and starts serving HTTP requests.
 func (s *Server) Run() {
 	s.configure()
 
@@ -142,6 +146,7 @@ func (s *Server) cleanShutdown() {
 	}
 }
 
+// MaintenanceMode returns whether the server is in maintenance mode.
 func (s *Server) MaintenanceMode() bool {
 	return s.params.Config.MaintenanceMode
 }