Fix golangci-lint v2 compliance, make all passes clean

- Fix 314 errcheck violations (blank identifier for unrecoverable errors)
- Fix errorlint violation (errors.Is for io.EOF)
- Remove unused serveL7Route test helper
- Simplify Duration.Seconds() selectors in tests
- Remove unnecessary fmt.Sprintf in test
- Migrate exclusion rules from issues.exclusions to linters.exclusions (v2 schema)
- Add gosec test exclusions (G115, G304, G402, G705)
- Disable fieldalignment govet analyzer (optimization, not correctness)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/config/config_test.go

@@ -304,7 +304,7 @@ func TestDuration(t *testing.T) {
 	if err := d.UnmarshalText([]byte("5s")); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	if d.Duration.Seconds() != 5 {
+	if d.Seconds() != 5 {
 		t.Fatalf("got %v, want 5s", d.Duration)
 	}
 }
@@ -340,7 +340,7 @@ level = "info"
 	if cfg.Log.Level != "debug" {
 		t.Fatalf("got log.level %q, want %q", cfg.Log.Level, "debug")
 	}
-	if cfg.Proxy.IdleTimeout.Duration.Seconds() != 600 {
+	if cfg.Proxy.IdleTimeout.Seconds() != 600 {
 		t.Fatalf("got idle_timeout %v, want 600s", cfg.Proxy.IdleTimeout.Duration)
 	}
 	if cfg.Database.Path != "/override/test.db" {