fix: clear golangci-lint backlog and make lint job blocking

Addresses errcheck, gosec, revive, staticcheck, and unused findings
across the codebase (unchecked error returns, unsafe file inclusion
warnings on operator/test-controlled paths, missing package comments,
unused parameters, deprecated API usage). Also fixes two suppression
comments that were silently no-ops due to wrong syntax (#nosec needs
a leading '#', nolint reasons need '//' not '--').

With the backlog clear, drop continue-on-error from the CI lint job
per the plan left in b4b4806.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/auth/auth.go

@@ -1,3 +1,7 @@
+// Package auth provides API key authentication and authorization for the
+// notifier service, including key storage backends (in-memory, database,
+// and a hybrid cache-plus-database store) and RBAC-style notifier
+// authorization.
 package auth
 
 import (
@@ -54,8 +58,8 @@ type RateLimiter struct {
 	mu          sync.Mutex
 }
 
-// AuthContext holds auth information attached to request context
-type AuthContext struct {
+// Context holds auth information attached to request context
+type Context struct {
 	APIKey   *APIKey
 	ClientID string
 	Roles    []string
@@ -283,12 +287,12 @@ func (s *APIKeyStore) ListKeys(clientID string) []*APIKey {
 type authContextKey struct{}
 
 // ContextWithAuth adds auth context to a request context
-func ContextWithAuth(ctx context.Context, auth *AuthContext) context.Context {
+func ContextWithAuth(ctx context.Context, auth *Context) context.Context {
 	return context.WithValue(ctx, authContextKey{}, auth)
 }
 
 // GetAuthContext retrieves auth context from a request context
-func GetAuthContext(ctx context.Context) (*AuthContext, bool) {
-	auth, ok := ctx.Value(authContextKey{}).(*AuthContext)
+func GetAuthContext(ctx context.Context) (*Context, bool) {
+	auth, ok := ctx.Value(authContextKey{}).(*Context)
 	return auth, ok
 }

internal/auth/authz.go

@@ -26,7 +26,7 @@ func (a *NotifierAuthz) RegisterRule(notificationType domain.NotificationType, a
 }
 
 // IsAuthorized checks if an auth context is authorized to use a specific notifier
-func (a *NotifierAuthz) IsAuthorized(auth *AuthContext, notificationType domain.NotificationType, account string) bool {
+func (a *NotifierAuthz) IsAuthorized(auth *Context, notificationType domain.NotificationType, account string) bool {
 	if auth == nil || len(auth.Roles) == 0 {
 		return false
 	}

internal/auth/bootstrap.go

@@ -183,7 +183,7 @@ func BootstrapAdminKey(ctx context.Context, keyStore *HybridKeyStore, cfg *Boots
 
 // LoadBootstrapKeyFromEnv checks if a bootstrap key was provided via environment variable
 // This allows injecting a pre-generated key via CI/CD
-func LoadBootstrapKeyFromEnv(ctx context.Context, keyStore *HybridKeyStore, logger *logging.Logger) error {
+func LoadBootstrapKeyFromEnv(_ context.Context, _ *HybridKeyStore, logger *logging.Logger) error {
 	bootstrapKey := os.Getenv("NOTIFIER_BOOTSTRAP_ADMIN_KEY")
 	if bootstrapKey == "" {
 		return nil // Not set, skip

internal/auth/grpc_middleware.go

@@ -55,7 +55,7 @@ func (m *GRPCAuthMiddleware) UnaryInterceptor() grpc.UnaryServerInterceptor {
 		}
 
 		// Create auth context and attach to request
-		authCtx := &AuthContext{
+		authCtx := &Context{
 			APIKey:   key,
 			ClientID: key.ClientID,
 			Roles:    key.Roles,
@@ -99,7 +99,7 @@ func (m *GRPCAuthMiddleware) StreamInterceptor() grpc.StreamServerInterceptor {
 		}
 
 		// Create auth context and attach to request
-		authCtx := &AuthContext{
+		authCtx := &Context{
 			APIKey:   key,
 			ClientID: key.ClientID,
 			Roles:    key.Roles,

internal/auth/keystore_db.go

@@ -128,7 +128,7 @@ func (ks *KeyStoreDB) migrateLegacyPlaintextKeys() error {
 	if err != nil {
 		return fmt.Errorf("failed to read legacy keys: %w", err)
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 
 	type legacyRow struct {
 		id  int
@@ -265,7 +265,7 @@ func (ks *KeyStoreDB) ListKeys(ctx context.Context, clientID string) ([]*APIKey,
 	if err != nil {
 		return nil, fmt.Errorf("failed to list keys: %w", err)
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 
 	var keys []*APIKey
 	for rows.Next() {
@@ -318,7 +318,7 @@ func (ks *KeyStoreDB) LoadAllKeys(ctx context.Context) ([]*APIKey, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to load keys: %w", err)
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 
 	var keys []*APIKey
 	for rows.Next() {
@@ -427,7 +427,7 @@ func (ks *KeyStoreDB) auditLogQuery(ctx context.Context, query string, ident str
 	if err != nil {
 		return nil, fmt.Errorf("failed to get audit log: %w", err)
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 
 	var logs []map[string]interface{}
 	for rows.Next() {

internal/auth/keystore_test.go

@@ -68,7 +68,7 @@ func (f *fakeKeyDB) DeactivateKeyByHash(_ context.Context, keyHash string, _ str
 	return nil
 }
 
-func (f *fakeKeyDB) UpdateLastUsed(_ context.Context, keyHash string) error { return nil }
+func (f *fakeKeyDB) UpdateLastUsed(_ context.Context, _ string) error { return nil }
 
 func (f *fakeKeyDB) LoadAllKeys(_ context.Context) ([]*APIKey, error) {
 	var keys []*APIKey

internal/auth/rest_middleware.go

@@ -55,7 +55,7 @@ func (m *RESTAuthMiddleware) Middleware(next http.Handler) http.Handler {
 		}
 
 		// Create auth context and attach to request
-		authCtx := &AuthContext{
+		authCtx := &Context{
 			APIKey:   key,
 			ClientID: key.ClientID,
 			Roles:    key.Roles,