lint: drive baseline to zero, drop only-new-issues gate

Cleanup pass over the repo so CI can enforce lint going forward
without the only-new-issues escape hatch:

* gofumpt -w across the tree (31 hits, all formatting)
* misspell --fix (25 hits, US-locale spelling) — but reverted on
  api.JobCancelled = "cancelled" since that literal is the wire +
  DB CHECK constraint value, plus matched the case in store/fleet.go
  back to "cancelled" and added //nolint:misspell on both for the
  next time someone reaches for the auto-fix
* Wrap every `defer rows.Close()` / `defer stmt.Close()` /
  `defer res.Body.Close()` in `defer func() { _ = .Close() }()`
  to satisfy errcheck without losing the close itself
* websocket.Dial callers (1 prod, 4 tests) now capture + close the
  upgrade response Body — coder/websocket can return res with a nil
  Body on success, so the test deferred-closes guard against that
* Annotate the two genuine-by-design nilerr cases with //nolint
  comments explaining why nil-on-error is the contract (cookie
  missing = no session; ctx cancelled mid-backoff = clean shutdown)
* Add brief godoc on the 10 exported const groups + types that
  revive flagged (api.HostOS/HostArch/JobKind/JobStatus/LogStream/
  ErrorCode, restic.EventKind, store.Role, web.FS)
* Drop the unused (*Server).userByID method
* Inline the unparam baseView(active) — every UI page is under
  the dashboard primary nav today

Result: `golangci-lint run ./...` reports 0 issues. CI lint job
no longer needs only-new-issues: true; X-06 follow-up entry in
tasks.md removed.

internal/store/snapshots_test.go

@@ -30,20 +30,20 @@ func TestReplaceHostSnapshotsRoundTrip(t *testing.T) {
 	now := time.Now().UTC().Truncate(time.Second)
 	in := []Snapshot{
 		{
-			ID: "deadbeef" + "00000000000000000000000000000000000000000000000000000000",
-			ShortID: "deadbeef",
-			Time: now.Add(-2 * time.Hour),
-			Hostname: "snap-host",
-			Paths: []string{"/etc", "/home"},
-			Tags: []string{"daily"},
+			ID:        "deadbeef" + "00000000000000000000000000000000000000000000000000000000",
+			ShortID:   "deadbeef",
+			Time:      now.Add(-2 * time.Hour),
+			Hostname:  "snap-host",
+			Paths:     []string{"/etc", "/home"},
+			Tags:      []string{"daily"},
 			SizeBytes: 4096, FileCount: 12,
 		},
 		{
-			ID: "cafef00d" + "00000000000000000000000000000000000000000000000000000000",
-			ShortID: "cafef00d",
-			Time: now.Add(-1 * time.Hour),
-			Hostname: "snap-host",
-			Paths: []string{"/etc"},
+			ID:        "cafef00d" + "00000000000000000000000000000000000000000000000000000000",
+			ShortID:   "cafef00d",
+			Time:      now.Add(-1 * time.Hour),
+			Hostname:  "snap-host",
+			Paths:     []string{"/etc"},
 			SizeBytes: 8192, FileCount: 24,
 		},
 	}
@@ -129,9 +129,11 @@ func TestReplaceHostSnapshotsEmpty(t *testing.T) {
 
 	// First a non-empty replace.
 	if err := s.ReplaceHostSnapshots(ctx, hostID, []Snapshot{
-		{ID: "1111111111111111111111111111111111111111111111111111111111111111",
+		{
+			ID:      "1111111111111111111111111111111111111111111111111111111111111111",
 			ShortID: "11111111", Time: time.Now().UTC(), Hostname: "snap-host",
-			Paths: []string{"/x"}},
+			Paths: []string{"/x"},
+		},
 	}, time.Now().UTC()); err != nil {
 		t.Fatalf("replace 1: %v", err)
 	}