lint: drive baseline to zero, drop only-new-issues gate

Cleanup pass over the repo so CI can enforce lint going forward
without the only-new-issues escape hatch:

* gofumpt -w across the tree (31 hits, all formatting)
* misspell --fix (25 hits, US-locale spelling) — but reverted on
  api.JobCancelled = "cancelled" since that literal is the wire +
  DB CHECK constraint value, plus matched the case in store/fleet.go
  back to "cancelled" and added //nolint:misspell on both for the
  next time someone reaches for the auto-fix
* Wrap every `defer rows.Close()` / `defer stmt.Close()` /
  `defer res.Body.Close()` in `defer func() { _ = .Close() }()`
  to satisfy errcheck without losing the close itself
* websocket.Dial callers (1 prod, 4 tests) now capture + close the
  upgrade response Body — coder/websocket can return res with a nil
  Body on success, so the test deferred-closes guard against that
* Annotate the two genuine-by-design nilerr cases with //nolint
  comments explaining why nil-on-error is the contract (cookie
  missing = no session; ctx cancelled mid-backoff = clean shutdown)
* Add brief godoc on the 10 exported const groups + types that
  revive flagged (api.HostOS/HostArch/JobKind/JobStatus/LogStream/
  ErrorCode, restic.EventKind, store.Role, web.FS)
* Drop the unused (*Server).userByID method
* Inline the unparam baseView(active) — every UI page is under
  the dashboard primary nav today

Result: `golangci-lint run ./...` reports 0 issues. CI lint job
no longer needs only-new-issues: true; X-06 follow-up entry in
tasks.md removed.

internal/server/http/hosts.go

@@ -10,23 +10,23 @@ import (
 // store row, but with explicit time-strings so wire format is stable
 // across DB driver changes.
 type hostView struct {
-	ID                string  `json:"id"`
-	Name              string  `json:"name"`
-	OS                string  `json:"os"`
-	Arch              string  `json:"arch"`
-	AgentVersion      string  `json:"agent_version,omitempty"`
-	ResticVersion     string  `json:"restic_version,omitempty"`
-	ProtocolVersion   int     `json:"protocol_version"`
-	EnrolledAt        string  `json:"enrolled_at"`
-	LastSeenAt        *string `json:"last_seen_at,omitempty"`
-	Status            string  `json:"status"`
-	Tags              []string `json:"tags"`
-	CurrentJobID      *string `json:"current_job_id,omitempty"`
-	LastBackupAt      *string `json:"last_backup_at,omitempty"`
-	LastBackupStatus  *string `json:"last_backup_status,omitempty"`
-	RepoSizeBytes     int64   `json:"repo_size_bytes"`
-	SnapshotCount     int     `json:"snapshot_count"`
-	OpenAlertCount    int     `json:"open_alert_count"`
+	ID               string   `json:"id"`
+	Name             string   `json:"name"`
+	OS               string   `json:"os"`
+	Arch             string   `json:"arch"`
+	AgentVersion     string   `json:"agent_version,omitempty"`
+	ResticVersion    string   `json:"restic_version,omitempty"`
+	ProtocolVersion  int      `json:"protocol_version"`
+	EnrolledAt       string   `json:"enrolled_at"`
+	LastSeenAt       *string  `json:"last_seen_at,omitempty"`
+	Status           string   `json:"status"`
+	Tags             []string `json:"tags"`
+	CurrentJobID     *string  `json:"current_job_id,omitempty"`
+	LastBackupAt     *string  `json:"last_backup_at,omitempty"`
+	LastBackupStatus *string  `json:"last_backup_status,omitempty"`
+	RepoSizeBytes    int64    `json:"repo_size_bytes"`
+	SnapshotCount    int      `json:"snapshot_count"`
+	OpenAlertCount   int      `json:"open_alert_count"`
 }
 
 // handleListHosts returns the full fleet as JSON. Authenticated; the