Fix linting: golangci-lint v2 config, nolint annotations

* Rewrite .golangci.yaml to v2 schema: linters-settings ->
  linters.settings, issues.exclude-rules -> issues.exclusions.rules,
  issues.exclude-dirs -> issues.exclusions.paths
* Drop deprecated revive exported/package-comments rules: personal
  project, not a public library; godoc completeness is not a CI req
* Add //nolint:gosec G101 on PassphraseEnv default in config.go:
  environment variable name is not a credential value
* Add //nolint:gosec G101 on EventPGCredUpdated in model.go:
  audit event type string, not a credential

Security: no logic changes. gosec G101 suppressions are false
positives confirmed by code inspection: neither constant holds a
credential value.

internal/db/db_test.go

@@ -1,6 +1,7 @@
 package db
 
 import (
+	"errors"
 	"testing"
 	"time"
 
@@ -69,12 +70,12 @@ func TestGetAccountNotFound(t *testing.T) {
 	db := openTestDB(t)
 
 	_, err := db.GetAccountByUUID("nonexistent-uuid")
-	if err != ErrNotFound {
+	if !errors.Is(err, ErrNotFound) {
 		t.Errorf("expected ErrNotFound, got %v", err)
 	}
 
 	_, err = db.GetAccountByUsername("nobody")
-	if err != ErrNotFound {
+	if !errors.Is(err, ErrNotFound) {
 		t.Errorf("expected ErrNotFound, got %v", err)
 	}
 }
@@ -221,7 +222,7 @@ func TestTokenTrackingAndRevocation(t *testing.T) {
 func TestGetTokenRecordNotFound(t *testing.T) {
 	db := openTestDB(t)
 	_, err := db.GetTokenRecord("no-such-jti")
-	if err != ErrNotFound {
+	if !errors.Is(err, ErrNotFound) {
 		t.Errorf("expected ErrNotFound, got %v", err)
 	}
 }
@@ -262,7 +263,7 @@ func TestServerConfig(t *testing.T) {
 
 	// No config initially.
 	_, _, err := db.ReadServerConfig()
-	if err != ErrNotFound {
+	if !errors.Is(err, ErrNotFound) {
 		t.Errorf("expected ErrNotFound for missing config, got %v", err)
 	}