fix: Address golangci-lint errors (errcheck, gosec) (#76)

Apply PR #76 from dannomayernotabot:

- Add golangci exclusions for internal package false positives
- Tighten file permissions (0644 -> 0600) for sensitive files
- Add ReadHeaderTimeout to HTTP server (slowloris prevention)
- Explicit error ignoring with _ = for intentional cases
- Add //nolint comments with justifications
- Spelling: cancelled -> canceled (US locale)

Co-Authored-By: dannomayernotabot <noreply@github.com>

🤖 Generated with Claude Code

internal/doctor/bd_daemon_check.go

@@ -44,7 +44,7 @@ func (c *BdDaemonCheck) Run(ctx *CheckContext) *CheckResult {
 		healthCmd.Dir = ctx.TownRoot
 		var healthOut bytes.Buffer
 		healthCmd.Stdout = &healthOut
-		healthCmd.Run() // Ignore error, health check is optional
+		_ = healthCmd.Run() // Ignore error, health check is optional
 
 		healthOutput := healthOut.String()
 		if strings.Contains(healthOutput, "HEALTHY") {