lint: drive baseline to zero, drop only-new-issues gate

Cleanup pass over the repo so CI can enforce lint going forward
without the only-new-issues escape hatch:

* gofumpt -w across the tree (31 hits, all formatting)
* misspell --fix (25 hits, US-locale spelling) — but reverted on
  api.JobCancelled = "cancelled" since that literal is the wire +
  DB CHECK constraint value, plus matched the case in store/fleet.go
  back to "cancelled" and added //nolint:misspell on both for the
  next time someone reaches for the auto-fix
* Wrap every `defer rows.Close()` / `defer stmt.Close()` /
  `defer res.Body.Close()` in `defer func() { _ = .Close() }()`
  to satisfy errcheck without losing the close itself
* websocket.Dial callers (1 prod, 4 tests) now capture + close the
  upgrade response Body — coder/websocket can return res with a nil
  Body on success, so the test deferred-closes guard against that
* Annotate the two genuine-by-design nilerr cases with //nolint
  comments explaining why nil-on-error is the contract (cookie
  missing = no session; ctx cancelled mid-backoff = clean shutdown)
* Add brief godoc on the 10 exported const groups + types that
  revive flagged (api.HostOS/HostArch/JobKind/JobStatus/LogStream/
  ErrorCode, restic.EventKind, store.Role, web.FS)
* Drop the unused (*Server).userByID method
* Inline the unparam baseView(active) — every UI page is under
  the dashboard primary nav today

Result: `golangci-lint run ./...` reports 0 issues. CI lint job
no longer needs only-new-issues: true; X-06 follow-up entry in
tasks.md removed.

internal/restic/runner.go

@@ -15,7 +15,7 @@ import (
 	"time"
 )
 
-// Locate resolves the path to the restic binary. Honour an explicit
+// Locate resolves the path to the restic binary. Honor an explicit
 // override if provided, else fall back to PATH.
 func Locate(override string) (string, error) {
 	if override != "" {
@@ -41,12 +41,12 @@ func Locate(override string) (string, error) {
 // never assign it back to Env, never pass it to slog. If anything
 // in this package ever needs to *log* a URL, use RedactURL.
 type Env struct {
-	Bin           string            // path to restic binary
-	RepoURL       string            // RESTIC_REPOSITORY (no embedded creds)
-	RepoUsername  string            // optional HTTP basic-auth user for rest: URLs
-	RepoPassword  string            // doubles as RESTIC_PASSWORD and (for rest:) HTTP basic-auth password
-	ExtraEnv      map[string]string // any other RESTIC_* / passthrough
-	WorkDir       string            // CWD; default = current
+	Bin          string            // path to restic binary
+	RepoURL      string            // RESTIC_REPOSITORY (no embedded creds)
+	RepoUsername string            // optional HTTP basic-auth user for rest: URLs
+	RepoPassword string            // doubles as RESTIC_PASSWORD and (for rest:) HTTP basic-auth password
+	ExtraEnv     map[string]string // any other RESTIC_* / passthrough
+	WorkDir      string            // CWD; default = current
 }
 
 // EventKind enumerates what we care about in restic's --json output
@@ -54,10 +54,12 @@ type Env struct {
 // switch on message_type.
 type EventKind string
 
+// Known message_type values restic --json emits during a backup.
+// Kept as constants so callers can switch without typo risk.
 const (
-	EventStatus     EventKind = "status"      // periodic progress
+	EventStatus     EventKind = "status" // periodic progress
 	EventVerbose    EventKind = "verbose_status"
-	EventSummary    EventKind = "summary"     // emitted once at end of backup
+	EventSummary    EventKind = "summary" // emitted once at end of backup
 	EventErrorEvent EventKind = "error"
 )
 
@@ -90,7 +92,7 @@ type BackupSummary struct {
 }
 
 // LineHandler receives every stdout/stderr line. event is non-nil
-// when the line is a recognised JSON status; raw always carries the
+// when the line is a recognized JSON status; raw always carries the
 // original text (so we can also tee to job_logs as `stdout`).
 type LineHandler func(stream string, raw string, event any)
 
@@ -256,7 +258,7 @@ func (e Env) RunInit(ctx context.Context, handle LineHandler) error {
 
 	// Sniff for "config file already exists" on stderr; if we see it
 	// we'll treat the non-zero exit as a soft success — running init
-	// against an already-initialised repo is a no-op semantically,
+	// against an already-initialized repo is a no-op semantically,
 	// not a failure. Wraps the caller's handle so the line still
 	// gets streamed verbatim to the operator-facing log.
 	alreadyInited := false
@@ -280,7 +282,7 @@ func (e Env) RunInit(ctx context.Context, handle LineHandler) error {
 	if werr := cmd.Wait(); werr != nil {
 		if alreadyInited {
 			if handle != nil {
-				handle("event", "repo already initialised — treating as success", nil)
+				handle("event", "repo already initialized — treating as success", nil)
 			}
 			return nil
 		}