lint: drive baseline to zero, drop only-new-issues gate

Cleanup pass over the repo so CI can enforce lint going forward
without the only-new-issues escape hatch:

* gofumpt -w across the tree (31 hits, all formatting)
* misspell --fix (25 hits, US-locale spelling) — but reverted on
  api.JobCancelled = "cancelled" since that literal is the wire +
  DB CHECK constraint value, plus matched the case in store/fleet.go
  back to "cancelled" and added //nolint:misspell on both for the
  next time someone reaches for the auto-fix
* Wrap every `defer rows.Close()` / `defer stmt.Close()` /
  `defer res.Body.Close()` in `defer func() { _ = .Close() }()`
  to satisfy errcheck without losing the close itself
* websocket.Dial callers (1 prod, 4 tests) now capture + close the
  upgrade response Body — coder/websocket can return res with a nil
  Body on success, so the test deferred-closes guard against that
* Annotate the two genuine-by-design nilerr cases with //nolint
  comments explaining why nil-on-error is the contract (cookie
  missing = no session; ctx cancelled mid-backoff = clean shutdown)
* Add brief godoc on the 10 exported const groups + types that
  revive flagged (api.HostOS/HostArch/JobKind/JobStatus/LogStream/
  ErrorCode, restic.EventKind, store.Role, web.FS)
* Drop the unused (*Server).userByID method
* Inline the unparam baseView(active) — every UI page is under
  the dashboard primary nav today

Result: `golangci-lint run ./...` reports 0 issues. CI lint job
no longer needs only-new-issues: true; X-06 follow-up entry in
tasks.md removed.

internal/auth/passwords.go

@@ -16,6 +16,7 @@ import (
 // argon2id parameters following RFC 9106 §4 "second
 // recommended option" (memory-constrained):
 //   - 64 MiB memory, 3 iterations, 4 lanes, 32-byte tag.
+//
 // These are tunable per-deployment if a beefy controller wants to
 // crank them; we ship a defensible default.
 const (
@@ -27,7 +28,9 @@ const (
 )
 
 // HashPassword returns an argon2id-encoded string of the form
-//   $argon2id$v=19$m=...,t=...,p=...$<salt>$<hash>
+//
+//	$argon2id$v=19$m=...,t=...,p=...$<salt>$<hash>
+//
 // safe to store in a TEXT column. The salt is freshly random per call.
 func HashPassword(password string) (string, error) {
 	salt := make([]byte, defaultSaltLen)
@@ -53,7 +56,7 @@ func VerifyPassword(encoded, password string) error {
 	parts := strings.Split(encoded, "$")
 	// "$argon2id$v=...$m=...,t=...,p=...$<salt>$<hash>" → 6 parts (leading empty)
 	if len(parts) != 6 || parts[1] != "argon2id" {
-		return errors.New("auth: unrecognised hash format")
+		return errors.New("auth: unrecognized hash format")
 	}
 	var version int
 	if _, err := fmt.Sscanf(parts[2], "v=%d", &version); err != nil {

internal/auth/passwords_test.go

@@ -41,7 +41,7 @@ func TestVerifyRejectsMalformed(t *testing.T) {
 		"",
 		"not-a-hash",
 		"$argon2i$v=19$m=64,t=3,p=4$AAAA$BBBB",  // wrong variant
-		"$argon2id$",                             // truncated
+		"$argon2id$",                            // truncated
 		"$argon2id$v=99$m=64,t=3,p=4$AAAA$BBBB", // bad version
 	}
 	for _, c := range cases {