fix: clear golangci-lint backlog and make lint job blocking

Addresses errcheck, gosec, revive, staticcheck, and unused findings
across the codebase (unchecked error returns, unsafe file inclusion
warnings on operator/test-controlled paths, missing package comments,
unused parameters, deprecated API usage). Also fixes two suppression
comments that were silently no-ops due to wrong syntax (#nosec needs
a leading '#', nolint reasons need '//' not '--').

With the backlog clear, drop continue-on-error from the CI lint job
per the plan left in b4b4806.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/config/config.go

@@ -1,3 +1,6 @@
+// Package config loads and validates the notifier service's configuration
+// (notifiers, queue, auth, retention, and related settings) from files,
+// environment variables, and defaults via viper.
 package config
 
 import (
@@ -281,7 +284,7 @@ func (c *Config) Validate() error {
 	}
 
 	if c.Queue.Type == "kafka" && c.Queue.Kafka == nil {
-		return fmt.Errorf("Kafka queue type selected but no Kafka configuration provided")
+		return fmt.Errorf("kafka queue type selected but no kafka configuration provided")
 	}
 
 	// Validate at least one notifier is configured

internal/config/config_test.go

@@ -10,7 +10,7 @@ func TestSanitizeDatabaseURL(t *testing.T) {
 		input    string
 		expected string
 	}{
-		{
+		{ //nolint:gosec // test fixture URL, not a real credential
 			name:     "PostgreSQL with password",
 			input:    "postgresql://user:password@localhost:5432/dbname",
 			expected: "postgresql://user:***REDACTED***@localhost:5432/dbname",
@@ -20,7 +20,7 @@ func TestSanitizeDatabaseURL(t *testing.T) {
 			input:    "postgresql://user@localhost:5432/dbname",
 			expected: "postgresql://user@localhost:5432/dbname",
 		},
-		{
+		{ //nolint:gosec // test fixture URL, not a real credential
 			name:     "MySQL with special characters in password",
 			input:    "mysql://root:SuperSecret123!@db.example.com:3306/mydb",
 			expected: "mysql://root:***REDACTED***@db.example.com:3306/mydb",
@@ -40,12 +40,12 @@ func TestSanitizeDatabaseURL(t *testing.T) {
 			input:    "postgresql://localhost:5432/dbname",
 			expected: "postgresql://localhost:5432/dbname",
 		},
-		{
+		{ //nolint:gosec // test fixture URL, not a real credential
 			name:     "PostgreSQL with password containing colons",
 			input:    "postgresql://user:pass:word@localhost:5432/dbname",
 			expected: "postgresql://user:***REDACTED***@localhost:5432/dbname",
 		},
-		{
+		{ //nolint:gosec // test fixture URL, not a real credential
 			name:     "PostgreSQL with complex hostname and port",
 			input:    "postgresql://admin:p@ssw0rd!@db-prod.example.com:5432/production",
 			expected: "postgresql://admin:***REDACTED***@db-prod.example.com:5432/production",