fix: Address golangci-lint errors (errcheck, gosec) (#76)

Apply PR #76 from dannomayernotabot:

- Add golangci exclusions for internal package false positives
- Tighten file permissions (0644 -> 0600) for sensitive files
- Add ReadHeaderTimeout to HTTP server (slowloris prevention)
- Explicit error ignoring with _ = for intentional cases
- Add //nolint comments with justifications
- Spelling: cancelled -> canceled (US locale)

Co-Authored-By: dannomayernotabot <noreply@github.com>

🤖 Generated with Claude Code

internal/beads/catalog.go

@@ -113,7 +113,7 @@ func (c *MoleculeCatalog) Count() int {
 // Each line should be a JSON object with id, title, and description fields.
 // The source parameter is added to each loaded molecule.
 func (c *MoleculeCatalog) LoadFromFile(path, source string) error {
-	file, err := os.Open(path)
+	file, err := os.Open(path) //nolint:gosec // G304: path is from trusted molecule catalog locations
 	if err != nil {
 		return err
 	}