Complete implementation: e2e tests, gofmt, hardening

- Add test/e2e: 11 end-to-end tests covering full login/logout,
  token renewal, admin account management, credential-never-in-response,
  unauthorised access, JWT alg confusion and alg:none attacks,
  revoked token rejection, system account token issuance,
  wrong-password vs unknown-user indistinguishability
- Apply gofmt to all source files (formatting only, no logic changes)
- Update .golangci.yaml for golangci-lint v2 (version field required,
  gosimple merged into staticcheck, formatters section separated)
- Update PROGRESS.md to reflect Phase 5 completion
Security:
  All 97 tests pass with go test -race ./... (zero race conditions).
  Adversarial JWT tests (alg confusion, alg:none) confirm the
  ValidateToken alg-first check is effective against both attack classes.
  Credential fields (PasswordHash, TOTPSecret*, PGPassword) confirmed
  absent from all API responses via both unit and e2e tests.
  go vet ./... clean. golangci-lint v2.6.2 incompatible with go1.26
  runtime; go vet used as linter until toolchain is updated.

internal/config/config.go

@@ -35,10 +35,10 @@ type DatabaseConfig struct {
 
 // TokensConfig holds JWT issuance settings.
 type TokensConfig struct {
-	Issuer         string        `toml:"issuer"`
-	DefaultExpiry  duration      `toml:"default_expiry"`
-	AdminExpiry    duration      `toml:"admin_expiry"`
-	ServiceExpiry  duration      `toml:"service_expiry"`
+	Issuer        string   `toml:"issuer"`
+	DefaultExpiry duration `toml:"default_expiry"`
+	AdminExpiry   duration `toml:"admin_expiry"`
+	ServiceExpiry duration `toml:"service_expiry"`
 }
 
 // Argon2Config holds Argon2id password hashing parameters.
@@ -46,7 +46,7 @@ type TokensConfig struct {
 // We enforce these minimums to prevent accidental weakening.
 type Argon2Config struct {
 	Time    uint32 `toml:"time"`
-	Memory  uint32 `toml:"memory"`  // KiB
+	Memory  uint32 `toml:"memory"` // KiB
 	Threads uint8  `toml:"threads"`
 }