ci: migrate .golangci.yml to v2 schema + only-new-issues gate

The bump from golangci-lint-action@v6 → v7 (which downloads the v2.x
binary) was blocking CI lint with 'unsupported version of the
configuration: ""' because .golangci.yml was still in the v1 schema.

Migrate the config to v2:
* version: "2" prelude
* disable-all → default: none
* linters-settings → linters.settings
* gofumpt + goimports move into formatters.enable + formatters.settings
* exclude-rules move into linters.exclusions.rules
* gosimple drops (folded into staticcheck in v2)

Fix the four lint hits in the new P2R-02 code:
* host_bandwidth.go: convert hostBandwidthRequest directly to
  hostBandwidthView via type conversion (S1016)
* ui_repo.go: drop unparam savedSection + status arguments from
  renderRepoPage (always "" / always 422 — split GET render from
  validation-fail render)
* ui_schedules.go: gofumpt formatting on the scheduleEditPage struct

Add only-new-issues: true to the lint job. The repo carries ~90
pre-existing findings (gofumpt drift × 31, misspell × 25, missing
godoc × 10, bodyclose × 6, errcheck × 12, …) accumulated before
lint was actually wired into CI. Without this gate, every PR would
fail on baseline noise instead of its own changes.

Track the cleanup as X-06 in tasks.md so the gate is temporary.

.gitea/workflows/ci.yml

@@ -41,6 +41,13 @@ jobs:
           # Bumping to a v2.x release built against current Go.
           version: v2.1.6
           args: --timeout=5m
+          # Only flag issues introduced by the PR. The repo carries
+          # ~90 pre-existing findings (mostly missing godoc comments
+          # + gofumpt drift + misspell) accumulated before lint was
+          # actually wired into CI; cleaning them up is its own piece
+          # of work tracked separately. Without this, every PR fails
+          # on baseline noise instead of its own changes.
+          only-new-issues: true
 
   build:
     name: Build (${{ matrix.goos }}/${{ matrix.goarch }})