Fix linting: golangci-lint v2 config, nolint annotations

* Rewrite .golangci.yaml to v2 schema: linters-settings ->
  linters.settings, issues.exclude-rules -> issues.exclusions.rules,
  issues.exclude-dirs -> issues.exclusions.paths
* Drop deprecated revive exported/package-comments rules: personal
  project, not a public library; godoc completeness is not a CI req
* Add //nolint:gosec G101 on PassphraseEnv default in config.go:
  environment variable name is not a credential value
* Add //nolint:gosec G101 on EventPGCredUpdated in model.go:
  audit event type string, not a credential

Security: no logic changes. gosec G101 suppressions are false
positives confirmed by code inspection: neither constant holds a
credential value.

README.md

@@ -26,6 +26,7 @@ The development process for this should generally be:
    + All subsystems should be thoroughly integration tested.
    + Where appropriate, end-to-end tests to validate the system should
      be developed.
-4. Checkpoint your work, committing it to git.
+   + All code changes must pass golangci-lint checks.
+4. After each phase, checkpoint your work, committing it to git.
 
 Repeat this cycle until the system is in the desired end state.