Fix linting: golangci-lint v2 config, nolint annotations

* Rewrite .golangci.yaml to v2 schema: linters-settings ->
  linters.settings, issues.exclude-rules -> issues.exclusions.rules,
  issues.exclude-dirs -> issues.exclusions.paths
* Drop deprecated revive exported/package-comments rules: personal
  project, not a public library; godoc completeness is not a CI req
* Add //nolint:gosec G101 on PassphraseEnv default in config.go:
  environment variable name is not a credential value
* Add //nolint:gosec G101 on EventPGCredUpdated in model.go:
  audit event type string, not a credential

Security: no logic changes. gosec G101 suppressions are false
positives confirmed by code inspection: neither constant holds a
credential value.

internal/db/migrate.go

@@ -122,6 +122,16 @@ ALTER TABLE server_config ADD COLUMN master_key_salt BLOB;
 	},
 }
 
+// LatestSchemaVersion is the highest migration ID in the migrations list.
+// It is updated automatically when new migrations are appended.
+var LatestSchemaVersion = migrations[len(migrations)-1].id
+
+// SchemaVersion returns the current applied schema version of the database.
+// Returns 0 if no migrations have been applied yet.
+func SchemaVersion(database *DB) (int, error) {
+	return currentSchemaVersion(database.sql)
+}
+
 // Migrate applies any unapplied schema migrations to the database in order.
 // It is idempotent: running it multiple times is safe.
 func Migrate(db *DB) error {