fix: add golangci-lint config and fix all lint errors

- Add .golangci.yml with v2 config (errcheck, govet, staticcheck, misspell, etc.)
- Fix 32 errcheck issues across config, discord, ntfy, server packages
- Fix misspelling: cancelled → canceled
- Fix staticcheck: use append(slice...) instead of loop
- Fix staticcheck: remove empty error branch
- Use t.Setenv instead of os.Setenv/Unsetenv in tests
- Update CI workflow: add lint job, release tagging, ntfy notifications

internal/config/config.go

@@ -180,7 +180,7 @@ func (c *Config) watchFileSecrets(ctx context.Context) {
 		slog.Error("failed to create fsnotify watcher", "error", err)
 		return
 	}
-	defer watcher.Close()
+	defer func() { _ = watcher.Close() }()
 
 	// Watch the secrets directory
 	// Kubernetes updates secrets by changing the symlink, so watch the parent