Fix golangci-lint v2 compliance, make all passes clean

- Fix 314 errcheck violations (blank identifier for unrecoverable errors)
- Fix errorlint violation (errors.Is for io.EOF)
- Remove unused serveL7Route test helper
- Simplify Duration.Seconds() selectors in tests
- Remove unnecessary fmt.Sprintf in test
- Migrate exclusion rules from issues.exclusions to linters.exclusions (v2 schema)
- Add gosec test exclusions (G115, G304, G402, G705)
- Disable fieldalignment govet analyzer (optimization, not correctness)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/server/server.go

@@ -235,7 +235,7 @@ func (s *Server) Run(ctx context.Context) error {
 		ln, err := net.Listen("tcp", ls.Addr)
 		if err != nil {
 			for _, l := range netListeners {
-				l.Close()
+				_ = l.Close()
 			}
 			return fmt.Errorf("listening on %s: %w", ls.Addr, err)
 		}
@@ -253,7 +253,7 @@ func (s *Server) Run(ctx context.Context) error {
 	s.logger.Info("shutting down")
 
 	for _, ln := range netListeners {
-		ln.Close()
+		_ = ln.Close()
 	}
 
 	done := make(chan struct{})
@@ -272,7 +272,7 @@ func (s *Server) Run(ctx context.Context) error {
 		<-done
 	}
 
-	s.fw.Close()
+	_ = s.fw.Close()
 	return nil
 }
 
@@ -294,7 +294,7 @@ func (s *Server) serve(ctx context.Context, ln net.Listener, ls *ListenerState)
 
 		// Enforce per-listener connection limit.
 		if ls.MaxConnections > 0 && ls.ActiveConnections.Load() >= ls.MaxConnections {
-			conn.Close()
+			_ = conn.Close()
 			s.logger.Debug("connection limit reached", "addr", ls.Addr, "limit", ls.MaxConnections)
 			continue
 		}
@@ -311,7 +311,7 @@ func (s *Server) forceCloseAll() {
 	for _, ls := range s.listeners {
 		ls.connMu.Lock()
 		for conn := range ls.activeConns {
-			conn.Close()
+			_ = conn.Close()
 		}
 		ls.connMu.Unlock()
 	}
@@ -321,7 +321,7 @@ func (s *Server) handleConn(ctx context.Context, conn net.Conn, ls *ListenerStat
 	defer s.wg.Done()
 	defer ls.ActiveConnections.Add(-1)
 	defer metrics.ConnectionsActive.WithLabelValues(ls.Addr).Dec()
-	defer conn.Close()
+	defer func() { _ = conn.Close() }()
 
 	ls.connMu.Lock()
 	ls.activeConns[conn] = struct{}{}
@@ -392,7 +392,7 @@ func (s *Server) handleL4(ctx context.Context, conn net.Conn, addr netip.Addr, c
 		s.logger.Error("backend dial failed", "hostname", hostname, "backend", route.Backend, "error", err)
 		return
 	}
-	defer backendConn.Close()
+	defer func() { _ = backendConn.Close() }()
 
 	// Send PROXY protocol v2 header to backend if configured.
 	if route.SendProxyProtocol {