lint: drive baseline to zero, drop only-new-issues gate

Cleanup pass over the repo so CI can enforce lint going forward
without the only-new-issues escape hatch:

* gofumpt -w across the tree (31 hits, all formatting)
* misspell --fix (25 hits, US-locale spelling) — but reverted on
  api.JobCancelled = "cancelled" since that literal is the wire +
  DB CHECK constraint value, plus matched the case in store/fleet.go
  back to "cancelled" and added //nolint:misspell on both for the
  next time someone reaches for the auto-fix
* Wrap every `defer rows.Close()` / `defer stmt.Close()` /
  `defer res.Body.Close()` in `defer func() { _ = .Close() }()`
  to satisfy errcheck without losing the close itself
* websocket.Dial callers (1 prod, 4 tests) now capture + close the
  upgrade response Body — coder/websocket can return res with a nil
  Body on success, so the test deferred-closes guard against that
* Annotate the two genuine-by-design nilerr cases with //nolint
  comments explaining why nil-on-error is the contract (cookie
  missing = no session; ctx cancelled mid-backoff = clean shutdown)
* Add brief godoc on the 10 exported const groups + types that
  revive flagged (api.HostOS/HostArch/JobKind/JobStatus/LogStream/
  ErrorCode, restic.EventKind, store.Role, web.FS)
* Drop the unused (*Server).userByID method
* Inline the unparam baseView(active) — every UI page is under
  the dashboard primary nav today

Result: `golangci-lint run ./...` reports 0 issues. CI lint job
no longer needs only-new-issues: true; X-06 follow-up entry in
tasks.md removed.

internal/server/ws/handler.go

@@ -42,14 +42,14 @@ type HandlerDeps struct {
 // enrollment) before the WS upgrade.
 //
 // Lifecycle:
-//   1. Bearer token resolves to a Host row.
-//   2. Upgrade.
-//   3. First message must be `hello`; protocol_version checked here.
-//   4. Loop: read messages, dispatch by type. Heartbeats touch the
-//      host row; job/log/repo messages forward to the relevant
-//      handlers (TODO: lands with P1-18 onward).
-//   5. On Read error or context cancel, mark host offline, unregister
-//      from the hub.
+//  1. Bearer token resolves to a Host row.
+//  2. Upgrade.
+//  3. First message must be `hello`; protocol_version checked here.
+//  4. Loop: read messages, dispatch by type. Heartbeats touch the
+//     host row; job/log/repo messages forward to the relevant
+//     handlers (TODO: lands with P1-18 onward).
+//  5. On Read error or context cancel, mark host offline, unregister
+//     from the hub.
 func AgentHandler(deps HandlerDeps) stdhttp.Handler {
 	return stdhttp.HandlerFunc(func(w stdhttp.ResponseWriter, r *stdhttp.Request) {
 		host, ok := authenticateAgent(r, deps.Store)
@@ -204,7 +204,7 @@ func dispatchAgentMessage(ctx context.Context, c *Conn, hostID string, env api.E
 			string(p.Status), p.ExitCode, p.Stats, errMsg, p.FinishedAt); err != nil {
 			slog.Warn("ws: mark job finished", "job_id", p.JobID, "err", err)
 		}
-		// repo_initialised_at projection has been removed — auto-init
+		// repo_initialized_at projection has been removed — auto-init
 		// at host enrolment makes "is the repo init'd" derivable from
 		// the latest init job's status, no separate column needed.
 		if deps.JobHub != nil {

internal/server/ws/hub.go

@@ -100,7 +100,7 @@ func NewConn(hostID string, c *websocket.Conn) *Conn {
 }
 
 // Send writes an envelope as a JSON text message. Concurrent calls
-// are serialised; the underlying socket is not safe for parallel
+// are serialized; the underlying socket is not safe for parallel
 // writers.
 func (c *Conn) Send(ctx context.Context, env api.Envelope) error {
 	c.writeMu.Lock()

internal/server/ws/hub_test.go

@@ -57,13 +57,18 @@ func TestWSHelloAndHeartbeat(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	c, _, err := websocket.Dial(ctx, url, &websocket.DialOptions{
+	c, res, err := websocket.Dial(ctx, url, &websocket.DialOptions{
 		HTTPHeader: stdhttp.Header{"Authorization": []string{"Bearer " + token}},
 	})
 	if err != nil {
 		t.Fatalf("dial: %v", err)
 	}
 	defer c.CloseNow()
+	defer func() {
+		if res != nil && res.Body != nil {
+			_ = res.Body.Close()
+		}
+	}()
 
 	// Send hello.
 	hello := api.HelloPayload{
@@ -125,13 +130,18 @@ func TestWSRejectsOldProtocol(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	c, _, err := websocket.Dial(ctx, url, &websocket.DialOptions{
+	c, res, err := websocket.Dial(ctx, url, &websocket.DialOptions{
 		HTTPHeader: stdhttp.Header{"Authorization": []string{"Bearer " + token}},
 	})
 	if err != nil {
 		t.Fatalf("dial: %v", err)
 	}
 	defer c.CloseNow()
+	defer func() {
+		if res != nil && res.Body != nil {
+			_ = res.Body.Close()
+		}
+	}()
 
 	hello := api.HelloPayload{ProtocolVersion: 0} // below minimum
 	env, _ := api.Marshal(api.MsgHello, "", hello)
@@ -170,6 +180,13 @@ func TestWSRejectsBadToken(t *testing.T) {
 	_, res, err := websocket.Dial(ctx, url, &websocket.DialOptions{
 		HTTPHeader: stdhttp.Header{"Authorization": []string{"Bearer wrong"}},
 	})
+	if res != nil {
+		defer func() {
+			if res != nil && res.Body != nil {
+				_ = res.Body.Close()
+			}
+		}()
+	}
 	if err == nil {
 		t.Fatal("dial should fail")
 	}

internal/server/ws/jobhub.go

@@ -33,7 +33,7 @@ func NewJobHub() *JobHub {
 // the hub's set (so concurrent Broadcasts will reach it), but no
 // pump goroutine runs yet. The caller can prime the channel via Send
 // — useful for late-subscriber catch-up — and then call Run to start
-// the pump. Run blocks until ctx is cancelled or conn dies, and
+// the pump. Run blocks until ctx is canceled or conn dies, and
 // unregisters on return.
 type Subscriber struct {
 	hub   *JobHub
@@ -73,7 +73,7 @@ func (s *Subscriber) Send(env api.Envelope) {
 }
 
 // Run pumps messages from the subscriber's channel onto conn until
-// ctx is cancelled or conn dies. Unregisters on return. Caller is
+// ctx is canceled or conn dies. Unregisters on return. Caller is
 // expected to invoke this from the goroutine that owns conn.
 func (s *Subscriber) Run(ctx context.Context, conn *Conn) {
 	defer s.unregister()