fix: clear golangci-lint backlog and make lint job blocking

Addresses errcheck, gosec, revive, staticcheck, and unused findings
across the codebase (unchecked error returns, unsafe file inclusion
warnings on operator/test-controlled paths, missing package comments,
unused parameters, deprecated API usage). Also fixes two suppression
comments that were silently no-ops due to wrong syntax (#nosec needs
a leading '#', nolint reasons need '//' not '--').

With the backlog clear, drop continue-on-error from the CI lint job
per the plan left in b4b4806.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

pkg/client/rest.go

@@ -8,6 +8,8 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
+	"strconv"
 	"time"
 )
 
@@ -22,7 +24,7 @@ type RESTClient struct {
 }
 
 // NewRESTClient creates a new REST client with the given config
-func NewRESTClient(cfg ClientConfig) *RESTClient {
+func NewRESTClient(cfg Config) *RESTClient {
 	if cfg.Timeout == 0 {
 		cfg.Timeout = 30 * time.Second
 	}
@@ -34,7 +36,7 @@ func NewRESTClient(cfg ClientConfig) *RESTClient {
 	}
 
 	tlsConfig := &tls.Config{
-		InsecureSkipVerify: cfg.TLSInsecure,
+		InsecureSkipVerify: cfg.TLSInsecure, // #nosec G402 -- explicit user opt-in (TLSInsecure) for self-signed test endpoints
 	}
 
 	httpClient := &http.Client{
@@ -134,9 +136,33 @@ func (c *RESTClient) GetNotification(ctx context.Context, id string) (*Notificat
 	return &notif, nil
 }
 
-// ListNotifications lists notifications with filters
+// ListNotifications lists notifications with filters. Filter fields are
+// encoded as query parameters matching the server's parseNotificationFilter
+// (limit, offset, repeated type/status/recipient).
 func (c *RESTClient) ListNotifications(ctx context.Context, filter ListNotificationsRequest) (*ListNotificationsResponse, error) {
-	respBody, statusCode, err := c.doRequest(ctx, "GET", "/api/v1/notifications", nil)
+	query := url.Values{}
+	if filter.Limit > 0 {
+		query.Set("limit", strconv.Itoa(filter.Limit))
+	}
+	if filter.Offset > 0 {
+		query.Set("offset", strconv.Itoa(filter.Offset))
+	}
+	for _, t := range filter.Types {
+		query.Add("type", t)
+	}
+	for _, s := range filter.Statuses {
+		query.Add("status", string(s))
+	}
+	for _, r := range filter.Recipients {
+		query.Add("recipient", r)
+	}
+
+	path := "/api/v1/notifications"
+	if encoded := query.Encode(); encoded != "" {
+		path += "?" + encoded
+	}
+
+	respBody, statusCode, err := c.doRequest(ctx, "GET", path, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -238,7 +264,7 @@ func (c *RESTClient) HealthCheck(ctx context.Context) (bool, error) {
 	if err != nil {
 		return false, fmt.Errorf("health check failed: %w", err)
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	return resp.StatusCode == http.StatusOK, nil
 }
@@ -281,7 +307,7 @@ func (c *RESTClient) doRequest(ctx context.Context, method, path string, body []
 		}
 
 		respBody, err := io.ReadAll(resp.Body)
-		resp.Body.Close()
+		_ = resp.Body.Close()
 
 		if err != nil {
 			lastErr = fmt.Errorf("failed to read response: %w", err)

pkg/client/types.go

@@ -1,3 +1,5 @@
+// Package client provides a Go client library and types for interacting
+// with the notifier service's REST API.
 package client
 
 import "time"
@@ -24,6 +26,7 @@ type NotificationResponse struct {
 // NotificationStatus represents the status of a notification
 type NotificationStatus string
 
+// Notification status values returned by the notifier service.
 const (
 	StatusPending  NotificationStatus = "pending"
 	StatusQueued   NotificationStatus = "queued"
@@ -89,8 +92,8 @@ type NotifiersResponse struct {
 	Notifiers []NotifierInfo `json:"notifiers"`
 }
 
-// ClientConfig contains configuration for the client
-type ClientConfig struct {
+// Config contains configuration for the client
+type Config struct {
 	BaseURL      string        // Base URL for REST API (e.g., "http://localhost:8080")
 	APIKey       string        // Optional API key for authentication
 	Timeout      time.Duration // Request timeout (default: 30s)
@@ -100,3 +103,7 @@ type ClientConfig struct {
 	// NEVER set this to true in production. Use proper certificates or provide custom CA certificates instead.
 	TLSInsecure bool
 }
+
+// ClientConfig is a backward-compatible alias for Config.
+// Deprecated: use Config.
+type ClientConfig = Config //nolint:revive // kept for API compatibility