fix: Address golangci-lint errors (errcheck, gosec) (#76)

Apply PR #76 from dannomayernotabot:

- Add golangci exclusions for internal package false positives
- Tighten file permissions (0644 -> 0600) for sensitive files
- Add ReadHeaderTimeout to HTTP server (slowloris prevention)
- Explicit error ignoring with _ = for intentional cases
- Add //nolint comments with justifications
- Spelling: cancelled -> canceled (US locale)

Co-Authored-By: dannomayernotabot <noreply@github.com>

🤖 Generated with Claude Code

internal/config/loader.go

@@ -27,7 +27,7 @@ var (
 
 // LoadTownConfig loads and validates a town configuration file.
 func LoadTownConfig(path string) (*TownConfig, error) {
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) //nolint:gosec // G304: path is from trusted config location
 	if err != nil {
 		if os.IsNotExist(err) {
 			return nil, fmt.Errorf("%w: %s", ErrNotFound, path)
@@ -62,7 +62,7 @@ func SaveTownConfig(path string, config *TownConfig) error {
 		return fmt.Errorf("encoding config: %w", err)
 	}
 
-	if err := os.WriteFile(path, data, 0644); err != nil {
+	if err := os.WriteFile(path, data, 0600); err != nil {
 		return fmt.Errorf("writing config: %w", err)
 	}
 
@@ -71,7 +71,7 @@ func SaveTownConfig(path string, config *TownConfig) error {
 
 // LoadRigsConfig loads and validates a rigs registry file.
 func LoadRigsConfig(path string) (*RigsConfig, error) {
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) //nolint:gosec // G304: path is constructed internally, not from user input
 	if err != nil {
 		if os.IsNotExist(err) {
 			return nil, fmt.Errorf("%w: %s", ErrNotFound, path)
@@ -106,7 +106,7 @@ func SaveRigsConfig(path string, config *RigsConfig) error {
 		return fmt.Errorf("encoding config: %w", err)
 	}
 
-	if err := os.WriteFile(path, data, 0644); err != nil {
+	if err := os.WriteFile(path, data, 0600); err != nil {
 		return fmt.Errorf("writing config: %w", err)
 	}
 
@@ -115,7 +115,7 @@ func SaveRigsConfig(path string, config *RigsConfig) error {
 
 // LoadAgentState loads an agent state file.
 func LoadAgentState(path string) (*AgentState, error) {
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) //nolint:gosec // G304: path is constructed internally, not from user input
 	if err != nil {
 		if os.IsNotExist(err) {
 			return nil, fmt.Errorf("%w: %s", ErrNotFound, path)
@@ -150,7 +150,7 @@ func SaveAgentState(path string, state *AgentState) error {
 		return fmt.Errorf("encoding state: %w", err)
 	}
 
-	if err := os.WriteFile(path, data, 0644); err != nil {
+	if err := os.WriteFile(path, data, 0644); err != nil { //nolint:gosec // G306: state files don't contain secrets
 		return fmt.Errorf("writing state: %w", err)
 	}
 
@@ -192,7 +192,7 @@ func validateAgentState(s *AgentState) error {
 
 // LoadRigConfig loads and validates a rig configuration file.
 func LoadRigConfig(path string) (*RigConfig, error) {
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) //nolint:gosec // G304: path is constructed internally, not from user input
 	if err != nil {
 		if os.IsNotExist(err) {
 			return nil, fmt.Errorf("%w: %s", ErrNotFound, path)
@@ -227,7 +227,7 @@ func SaveRigConfig(path string, config *RigConfig) error {
 		return fmt.Errorf("encoding config: %w", err)
 	}
 
-	if err := os.WriteFile(path, data, 0644); err != nil {
+	if err := os.WriteFile(path, data, 0644); err != nil { //nolint:gosec // G306: config files don't contain secrets
 		return fmt.Errorf("writing config: %w", err)
 	}
 
@@ -315,7 +315,7 @@ func NewRigSettings() *RigSettings {
 
 // LoadRigSettings loads and validates a rig settings file.
 func LoadRigSettings(path string) (*RigSettings, error) {
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) //nolint:gosec // G304: path is constructed internally, not from user input
 	if err != nil {
 		if os.IsNotExist(err) {
 			return nil, fmt.Errorf("%w: %s", ErrNotFound, path)
@@ -350,7 +350,7 @@ func SaveRigSettings(path string, settings *RigSettings) error {
 		return fmt.Errorf("encoding settings: %w", err)
 	}
 
-	if err := os.WriteFile(path, data, 0644); err != nil {
+	if err := os.WriteFile(path, data, 0644); err != nil { //nolint:gosec // G306: settings files don't contain secrets
 		return fmt.Errorf("writing settings: %w", err)
 	}
 
@@ -359,7 +359,7 @@ func SaveRigSettings(path string, settings *RigSettings) error {
 
 // LoadMayorConfig loads and validates a mayor config file.
 func LoadMayorConfig(path string) (*MayorConfig, error) {
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) //nolint:gosec // G304: path is constructed internally, not from user input
 	if err != nil {
 		if os.IsNotExist(err) {
 			return nil, fmt.Errorf("%w: %s", ErrNotFound, path)
@@ -394,7 +394,7 @@ func SaveMayorConfig(path string, config *MayorConfig) error {
 		return fmt.Errorf("encoding config: %w", err)
 	}
 
-	if err := os.WriteFile(path, data, 0644); err != nil {
+	if err := os.WriteFile(path, data, 0644); err != nil { //nolint:gosec // G306: config files don't contain secrets
 		return fmt.Errorf("writing config: %w", err)
 	}
 
@@ -422,7 +422,7 @@ func NewMayorConfig() *MayorConfig {
 
 // LoadAccountsConfig loads and validates an accounts configuration file.
 func LoadAccountsConfig(path string) (*AccountsConfig, error) {
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) //nolint:gosec // G304: path is constructed internally, not from user input
 	if err != nil {
 		if os.IsNotExist(err) {
 			return nil, fmt.Errorf("%w: %s", ErrNotFound, path)
@@ -457,7 +457,7 @@ func SaveAccountsConfig(path string, config *AccountsConfig) error {
 		return fmt.Errorf("encoding accounts config: %w", err)
 	}
 
-	if err := os.WriteFile(path, data, 0644); err != nil {
+	if err := os.WriteFile(path, data, 0644); err != nil { //nolint:gosec // G306: accounts config doesn't contain sensitive credentials
 		return fmt.Errorf("writing accounts config: %w", err)
 	}
 
@@ -569,7 +569,7 @@ func expandPath(path string) string {
 
 // LoadMessagingConfig loads and validates a messaging configuration file.
 func LoadMessagingConfig(path string) (*MessagingConfig, error) {
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) //nolint:gosec // G304: path is constructed internally, not from user input
 	if err != nil {
 		if os.IsNotExist(err) {
 			return nil, fmt.Errorf("%w: %s", ErrNotFound, path)
@@ -604,7 +604,7 @@ func SaveMessagingConfig(path string, config *MessagingConfig) error {
 		return fmt.Errorf("encoding messaging config: %w", err)
 	}
 
-	if err := os.WriteFile(path, data, 0644); err != nil {
+	if err := os.WriteFile(path, data, 0644); err != nil { //nolint:gosec // G306: messaging config doesn't contain secrets
 		return fmt.Errorf("writing messaging config: %w", err)
 	}