ci: bump golangci-lint to v2.13.1 to fix panic on Go 1.27 (#1561)

CI is red on `main` and on every open PR (including the Dependabot PRs
#1531, #1552–#1554) with:

```
panic: file requires newer Go version go1.27 (application built with go1.26)
golangci-lint exit with code 2
```

## Cause

`actions/setup-go` with `go-version: 'stable'` started resolving to
**go1.27.0**. The pinned golangci-lint **v2.11.4** release binary is
built with **go1.26**, and its `go/types` refuses to typecheck source
files declaring a newer language version. Nothing in the failing PRs is
at fault.

## Fix

Bump to **golangci-lint v2.13.1**, whose release binaries are built with
go1.27, so linting works under `stable` again.

That bump also pulls in newer linter versions, which surface 57 findings
this tree did not have before. Handled as follows:

| Linter | Count | Resolution |
|---|---|---|
| `goconst` | 50 | 39 were repeated literals in `_test.go` files —
goconst started counting those in v2.12.0 (golangci-lint#6480 exposed
`ignore-tests`). Fixture data like `"1.0.0"` (89 occurrences) is not a
missing constant, so `goconst.ignore-tests: true`. The other 11 were
real duplication in production code (OpenAPI tags, the `bearer` security
scheme name, `$ref`, `http`/`https`) and became named constants. |
| `gosec` G710 | 1 | **True positive, fixed.** See below. |
| `staticcheck` SA1019 | 6 | Go 1.26 deprecated `ecdsa.PublicKey.X/Y`
and `PrivateKey.D`. Annotated with the same targeted `nolint` +
rationale already used for `ScalarBaseMult` in
`cmd/publisher/auth/common.go`. |

### The open redirect is real

`TrailingSlashMiddleware` copied the entire `*url.URL` before rewriting
the path. For an absolute-form request URI — legal for a Go HTTP server
to parse, e.g. `GET http://evil.com/foo/ HTTP/1.1` — `r.URL.Scheme` and
`r.URL.Host` are populated, and they were echoed straight back in the
`Location` header. The redirect target is now built from the cleaned
path and query alone. The existing `path.Clean` hardening for
GHSA-v8vw-gw5j-w7m6 (protocol-relative `//evil.com/`) is unchanged.

### Also

Switched `gomodguard` → `gomodguard_v2`; the former is deprecated as of
v2.12.0 and was emitting a warning on every run.

## Verification

- `golangci-lint v2.13.1` against this tree: **0 issues**, no
deprecation warnings
- `make validate`: all validations passed
- `go build ./...` and tests for every touched package pass (DB-backed
tests need Postgres; left to CI)

## Note on migrating the ecdsa key paths

Moving those six sites to `PublicKey.Bytes` /
`ParseUncompressedPublicKey` / `crypto/ecdh` touches key parsing and
signature verification. It should be its own reviewed PR rather than
riding along on a CI unblock. Happy to open one.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

tools/extract-server-schema/main.go

@@ -14,6 +14,9 @@ import (
 const (
 	openAPIPath     = "docs/reference/api/openapi.yaml"
 	schemaOutputDir = "docs/reference/server-json/draft"
+
+	// refKey is the JSON Schema reference key.
+	refKey = "$ref"
 )
 
 func main() {
@@ -99,7 +102,7 @@ func main() {
 		"$schema":     "http://json-schema.org/draft-07/schema#",
 		"$id":         schemaID,
 		"title":       "server.json defining a Model Context Protocol (MCP) server",
-		"$ref":        "#/definitions/ServerDetail",
+		refKey:        "#/definitions/ServerDetail",
 		"definitions": definitions,
 	}
 
@@ -148,7 +151,7 @@ func findReferencedSchemas(obj interface{}, found map[string]bool) {
 	switch v := obj.(type) {
 	case map[string]interface{}:
 		for key, value := range v {
-			if key == "$ref" {
+			if key == refKey {
 				if ref, ok := value.(string); ok {
 					// Extract schema name from #/components/schemas/SchemaName
 					if strings.HasPrefix(ref, "#/components/schemas/") {
@@ -173,7 +176,7 @@ func replaceComponentRefs(obj interface{}) interface{} {
 	case map[string]interface{}:
 		result := make(map[string]interface{})
 		for key, value := range v {
-			if key == "$ref" {
+			if key == refKey {
 				if ref, ok := value.(string); ok {
 					// Replace the reference path
 					result[key] = strings.ReplaceAll(ref, "#/components/schemas/", "#/definitions/")