Checkpoint: fix all lint warnings

- errorlint: use errors.Is for ErrSealed comparisons in vault_test.go
- gofmt: reformat config, config_test, middleware_test with goimports
- govet/fieldalignment: reorder struct fields in vault.go, csrf.go,
  detail_test.go, middleware_test.go for optimal alignment
- unused: remove unused newCSRFManager in csrf.go (superseded by
  newCSRFManagerFromVault)
- revive/early-return: invert sealed-vault condition in main.go

Security: no auth/crypto logic changed; struct reordering and error
comparison fixes only. newCSRFManager removal is safe — it was never
called; all CSRF construction goes through newCSRFManagerFromVault.

Co-authored-by: Junie <junie@jetbrains.com>

internal/audit/detail_test.go

@@ -7,9 +7,9 @@ import (
 
 func TestJSON(t *testing.T) {
 	tests := []struct {
+		verify func(t *testing.T, result string)
 		name   string
 		pairs  []string
-		verify func(t *testing.T, result string)
 	}{
 		{
 			name:  "single pair",
@@ -109,9 +109,9 @@ func TestJSON(t *testing.T) {
 
 func TestJSONWithRoles(t *testing.T) {
 	tests := []struct {
+		verify func(t *testing.T, result string)
 		name   string
 		roles  []string
-		verify func(t *testing.T, result string)
 	}{
 		{
 			name:  "multiple roles",