Fix golangci-lint v2 compliance, make all passes clean

- Fix 314 errcheck violations (blank identifier for unrecoverable errors)
- Fix errorlint violation (errors.Is for io.EOF)
- Remove unused serveL7Route test helper
- Simplify Duration.Seconds() selectors in tests
- Remove unnecessary fmt.Sprintf in test
- Migrate exclusion rules from issues.exclusions to linters.exclusions (v2 schema)
- Add gosec test exclusions (G115, G304, G402, G705)
- Disable fieldalignment govet analyzer (optimization, not correctness)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/db/db_test.go

@@ -17,7 +17,7 @@ func openTestDB(t *testing.T) *Store {
 	if err := store.Migrate(); err != nil {
 		t.Fatalf("migrate: %v", err)
 	}
-	t.Cleanup(func() { store.Close() })
+	t.Cleanup(func() { _ = store.Close() })
 	return store
 }
 
@@ -266,8 +266,8 @@ func TestRouteCascadeDelete(t *testing.T) {
 	store := openTestDB(t)
 
 	listenerID, _ := store.CreateListener(":443", false, 0)
-	store.CreateRoute(listenerID, "a.example.com", "127.0.0.1:8443", "l4", "", "", false, false)
-	store.CreateRoute(listenerID, "b.example.com", "127.0.0.1:9443", "l4", "", "", false, false)
+	_, _ = store.CreateRoute(listenerID, "a.example.com", "127.0.0.1:8443", "l4", "", "", false, false)
+	_, _ = store.CreateRoute(listenerID, "b.example.com", "127.0.0.1:9443", "l4", "", "", false, false)
 
 	if err := store.DeleteListener(listenerID); err != nil {
 		t.Fatalf("delete listener: %v", err)
@@ -412,7 +412,7 @@ func TestSeed(t *testing.T) {
 func TestSnapshot(t *testing.T) {
 	store := openTestDB(t)
 
-	store.CreateListener(":443", false, 0)
+	_, _ = store.CreateListener(":443", false, 0)
 
 	dest := filepath.Join(t.TempDir(), "backup.db")
 	if err := store.Snapshot(dest); err != nil {
@@ -424,7 +424,7 @@ func TestSnapshot(t *testing.T) {
 	if err != nil {
 		t.Fatalf("open backup: %v", err)
 	}
-	defer backup.Close()
+	defer func() { _ = backup.Close() }()
 
 	if err := backup.Migrate(); err != nil {
 		t.Fatalf("migrate backup: %v", err)
@@ -463,7 +463,7 @@ func TestMigrationV2Upgrade(t *testing.T) {
 	if err != nil {
 		t.Fatalf("open: %v", err)
 	}
-	t.Cleanup(func() { store.Close() })
+	t.Cleanup(func() { _ = store.Close() })
 
 	// Run full migrations (v1 + v2).
 	if err := store.Migrate(); err != nil {
@@ -556,10 +556,10 @@ func TestL7PolicyCascadeDelete(t *testing.T) {
 
 	lid, _ := store.CreateListener(":443", false, 0)
 	rid, _ := store.CreateRoute(lid, "api.test", "127.0.0.1:8080", "l7", "/c.pem", "/k.pem", false, false)
-	store.CreateL7Policy(rid, "block_user_agent", "Bot")
+	_, _ = store.CreateL7Policy(rid, "block_user_agent", "Bot")
 
 	// Deleting the route should cascade-delete its policies.
-	store.DeleteRoute(lid, "api.test")
+	_ = store.DeleteRoute(lid, "api.test")
 
 	policies, _ := store.ListL7Policies(rid)
 	if len(policies) != 0 {
@@ -585,7 +585,7 @@ func TestGetRouteID(t *testing.T) {
 	store := openTestDB(t)
 
 	lid, _ := store.CreateListener(":443", false, 0)
-	store.CreateRoute(lid, "api.test", "127.0.0.1:8080", "l7", "/c.pem", "/k.pem", false, false)
+	_, _ = store.CreateRoute(lid, "api.test", "127.0.0.1:8080", "l7", "/c.pem", "/k.pem", false, false)
 
 	rid, err := store.GetRouteID(lid, "api.test")
 	if err != nil {

internal/db/firewall.go

@@ -15,7 +15,7 @@ func (s *Store) ListFirewallRules() ([]FirewallRule, error) {
 	if err != nil {
 		return nil, fmt.Errorf("querying firewall rules: %w", err)
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 
 	var rules []FirewallRule
 	for rows.Next() {

internal/db/l7policies.go

@@ -19,7 +19,7 @@ func (s *Store) ListL7Policies(routeID int64) ([]L7Policy, error) {
 	if err != nil {
 		return nil, fmt.Errorf("querying l7 policies: %w", err)
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 
 	var policies []L7Policy
 	for rows.Next() {

internal/db/listeners.go

@@ -16,7 +16,7 @@ func (s *Store) ListListeners() ([]Listener, error) {
 	if err != nil {
 		return nil, fmt.Errorf("querying listeners: %w", err)
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 
 	var listeners []Listener
 	for rows.Next() {

internal/db/routes.go

@@ -25,7 +25,7 @@ func (s *Store) ListRoutes(listenerID int64) ([]Route, error) {
 	if err != nil {
 		return nil, fmt.Errorf("querying routes: %w", err)
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 
 	var routes []Route
 	for rows.Next() {

internal/db/seed.go

@@ -14,7 +14,7 @@ func (s *Store) Seed(listeners []config.Listener, fw config.Firewall) error {
 	if err != nil {
 		return fmt.Errorf("beginning seed transaction: %w", err)
 	}
-	defer tx.Rollback()
+	defer func() { _ = tx.Rollback() }()
 
 	for _, l := range listeners {
 		result, err := tx.Exec(