fix: clear golangci-lint backlog and make lint job blocking

Addresses errcheck, gosec, revive, staticcheck, and unused findings
across the codebase (unchecked error returns, unsafe file inclusion
warnings on operator/test-controlled paths, missing package comments,
unused parameters, deprecated API usage). Also fixes two suppression
comments that were silently no-ops due to wrong syntax (#nosec needs
a leading '#', nolint reasons need '//' not '--').

With the backlog clear, drop continue-on-error from the CI lint job
per the plan left in b4b4806.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

cmd/client/main.go

@@ -1,3 +1,5 @@
+// Command client is a CLI for sending and managing notifications through
+// the notifier service's REST API.
 package main
 
 import (
@@ -107,7 +109,7 @@ Options:
 	account := fs.String("account", "", "")
 	recipients := fs.String("recipients", "", "")
 
-	fs.Parse(args)
+	_ = fs.Parse(args) // flag.ExitOnError means Parse never returns a non-nil error
 
 	if *notifType == "" || *body == "" {
 		fmt.Fprintf(os.Stderr, "Error: --type and --body are required\n")
@@ -118,7 +120,7 @@ Options:
 	ctx, cancel := context.WithTimeout(context.Background(), *timeout)
 	defer cancel()
 
-	cfg := client.ClientConfig{
+	cfg := client.Config{
 		BaseURL:     *baseURL,
 		APIKey:      *apiKey,
 		Timeout:     *timeout,
@@ -174,7 +176,7 @@ Options:
 	timeout := fs.Duration("timeout", 30*time.Second, "")
 	id := fs.String("id", "", "")
 
-	fs.Parse(args)
+	_ = fs.Parse(args) // flag.ExitOnError means Parse never returns a non-nil error
 
 	if *id == "" {
 		fmt.Fprintf(os.Stderr, "Error: --id is required\n")
@@ -185,7 +187,7 @@ Options:
 	ctx, cancel := context.WithTimeout(context.Background(), *timeout)
 	defer cancel()
 
-	cfg := client.ClientConfig{
+	cfg := client.Config{
 		BaseURL:     *baseURL,
 		APIKey:      *apiKey,
 		Timeout:     *timeout,
@@ -231,12 +233,12 @@ Options:
 	limit := fs.Int("limit", 10, "")
 	offset := fs.Int("offset", 0, "")
 
-	fs.Parse(args)
+	_ = fs.Parse(args) // flag.ExitOnError means Parse never returns a non-nil error
 
 	ctx, cancel := context.WithTimeout(context.Background(), *timeout)
 	defer cancel()
 
-	cfg := client.ClientConfig{
+	cfg := client.Config{
 		BaseURL:     *baseURL,
 		APIKey:      *apiKey,
 		Timeout:     *timeout,
@@ -290,12 +292,12 @@ Options:
 	apiKey := fs.String("key", "", "")
 	timeout := fs.Duration("timeout", 30*time.Second, "")
 
-	fs.Parse(args)
+	_ = fs.Parse(args) // flag.ExitOnError means Parse never returns a non-nil error
 
 	ctx, cancel := context.WithTimeout(context.Background(), *timeout)
 	defer cancel()
 
-	cfg := client.ClientConfig{
+	cfg := client.Config{
 		BaseURL:     *baseURL,
 		APIKey:      *apiKey,
 		Timeout:     *timeout,
@@ -333,12 +335,12 @@ Options:
 	apiKey := fs.String("key", "", "")
 	timeout := fs.Duration("timeout", 30*time.Second, "")
 
-	fs.Parse(args)
+	_ = fs.Parse(args) // flag.ExitOnError means Parse never returns a non-nil error
 
 	ctx, cancel := context.WithTimeout(context.Background(), *timeout)
 	defer cancel()
 
-	cfg := client.ClientConfig{
+	cfg := client.Config{
 		BaseURL:     *baseURL,
 		APIKey:      *apiKey,
 		Timeout:     *timeout,
@@ -374,12 +376,12 @@ Options:
 	baseURL := fs.String("url", "http://localhost:8080", "")
 	timeout := fs.Duration("timeout", 30*time.Second, "")
 
-	fs.Parse(args)
+	_ = fs.Parse(args) // flag.ExitOnError means Parse never returns a non-nil error
 
 	ctx, cancel := context.WithTimeout(context.Background(), *timeout)
 	defer cancel()
 
-	cfg := client.ClientConfig{
+	cfg := client.Config{
 		BaseURL:     *baseURL,
 		Timeout:     *timeout,
 		TLSInsecure: false,
@@ -396,8 +398,7 @@ Options:
 	if healthy {
 		fmt.Println("Service is healthy")
 		os.Exit(0)
-	} else {
-		fmt.Println("Service is unhealthy")
-		os.Exit(1)
 	}
+	fmt.Println("Service is unhealthy")
+	os.Exit(1)
 }

cmd/server/main.go

@@ -1,3 +1,5 @@
+// Command server runs the notifier service, exposing its REST and gRPC
+// APIs and wiring up configuration, queueing, auth, and metrics.
 package main
 
 import (
@@ -364,7 +366,7 @@ func registerNotifiers(cfg *config.Config, factory *notifier.Factory, logger *lo
 	}
 }
 
-func startGRPCServer(ctx context.Context, wg *sync.WaitGroup, cfg *config.Config, svc domain.NotificationService, logger *logging.Logger, authStore *auth.APIKeyStore) *grpc.Server {
+func startGRPCServer(_ context.Context, wg *sync.WaitGroup, cfg *config.Config, svc domain.NotificationService, logger *logging.Logger, authStore *auth.APIKeyStore) *grpc.Server {
 	addr := fmt.Sprintf("%s:%d", cfg.Server.Host, cfg.Server.GRPCPort)
 
 	lis, err := net.Listen("tcp", addr)
@@ -425,7 +427,7 @@ func startGRPCServer(ctx context.Context, wg *sync.WaitGroup, cfg *config.Config
 	return grpcServer
 }
 
-func startRESTServer(ctx context.Context, wg *sync.WaitGroup, cfg *config.Config, svc domain.NotificationService, logger *logging.Logger, authStore *auth.APIKeyStore, hybridKeyStore *auth.HybridKeyStore, readiness map[string]rest.ReadinessCheck, collector *metrics.Collector) *http.Server {
+func startRESTServer(_ context.Context, wg *sync.WaitGroup, cfg *config.Config, svc domain.NotificationService, logger *logging.Logger, authStore *auth.APIKeyStore, hybridKeyStore *auth.HybridKeyStore, readiness map[string]rest.ReadinessCheck, collector *metrics.Collector) *http.Server {
 	opts := rest.RouterOptions{
 		Service:   svc,
 		Logger:    logger,