Fix linting: golangci-lint v2 config, nolint annotations

* Rewrite .golangci.yaml to v2 schema: linters-settings ->
  linters.settings, issues.exclude-rules -> issues.exclusions.rules,
  issues.exclude-dirs -> issues.exclusions.paths
* Drop deprecated revive exported/package-comments rules: personal
  project, not a public library; godoc completeness is not a CI req
* Add //nolint:gosec G101 on PassphraseEnv default in config.go:
  environment variable name is not a credential value
* Add //nolint:gosec G101 on EventPGCredUpdated in model.go:
  audit event type string, not a credential

Security: no logic changes. gosec G101 suppressions are false
positives confirmed by code inspection: neither constant holds a
credential value.

internal/middleware/middleware.go

@@ -217,7 +217,7 @@ func (l *ipRateLimiter) allow(ip string) bool {
 
 	now := time.Now()
 	elapsed := now.Sub(entry.lastSeen).Seconds()
-	entry.tokens = min(l.burst, entry.tokens+elapsed*l.rps)
+	entry.tokens = minFloat64(l.burst, entry.tokens+elapsed*l.rps)
 	entry.lastSeen = now
 
 	if entry.tokens < 1 {
@@ -281,8 +281,8 @@ func WriteError(w http.ResponseWriter, status int, message, code string) {
 	writeError(w, status, message, code)
 }
 
-// min returns the smaller of two float64 values.
-func min(a, b float64) float64 {
+// minFloat64 returns the smaller of two float64 values.
+func minFloat64(a, b float64) float64 {
 	if a < b {
 		return a
 	}