autoresearch iter 22: delete lint suppressions that suppress nothing

24 of the 96 nolint directives were dead: they covered findings that no
longer exist. A stale suppression is not inert — it silently claims any
future finding for that linter in that scope, so a real problem raised
there would vanish without anyone noticing. Explanatory prose was kept as
ordinary comments.

Two directives proved load-bearing under the project gate even though
nolintlint reported them unused, and removing them exposed verified
contextcheck false positives: App.Run does forward a sigCtx derived from
the caller's context to Start, and the migration lock renewal must keep
its own deadline because the task context may already be canceled. Both
were restored, narrowed to the live linter, and given the reason the
originals lacked.

backend/plugins/domain/admin/repository/db.go

@@ -327,7 +327,7 @@ func GetPostgresInfo(ctx context.Context) model.DatabaseInfoResponse {
 
 // OpenSQLiteExportFile opens the active SQLite database file together with its stat info.
 func OpenSQLiteExportFile() (*os.File, os.FileInfo, error) {
-	//nolint:gosec // export db file path is trusted
+	// export db file path is trusted
 	f, err := os.Open(sqliteDatabasePath())
 	if err != nil {
 		return nil, nil, fmt.Errorf("%s: %w", errs.ErrOpenDatabaseFileFailed, err)

backend/plugins/domain/cap/pow/prng.go

@@ -10,7 +10,7 @@ import (
 
 // fnv1a returns the 32-bit FNV-1a hash of a string
 //
-//nolint:mnd // FNV-1a 算法位移常量
+// FNV-1a 算法位移常量
 func fnv1a(str string) uint32 {
 	var hash uint32 = 2166136261
 	for i := 0; i < len(str); i++ {
@@ -22,7 +22,7 @@ func fnv1a(str string) uint32 {
 
 // fnv1aResume resumes FNV-1a hashing from a given state
 //
-//nolint:mnd // FNV-1a 算法位移常量
+// FNV-1a 算法位移常量
 func fnv1aResume(state uint32, str string) uint32 {
 	h := state
 	for i := 0; i < len(str); i++ {
@@ -33,15 +33,13 @@ func fnv1aResume(state uint32, str string) uint32 {
 }
 
 // hashShift computes FNV-1a mix additions
-//
-//nolint:mnd
 func hashShift(h uint32) uint32 {
 	return (h << 1) + (h << 4) + (h << 7) + (h << 8) + (h << 24)
 }
 
 // prngFromHash generates a hex string of specified length using an initial hash state
 //
-//nolint:mnd // xorshift 算法位移常量
+// xorshift 算法位移常量
 func prngFromHash(initialHash uint32, length int) string {
 	state := initialHash
 	var result strings.Builder

backend/plugins/domain/message_gateway/push/custom.go

@@ -68,7 +68,7 @@ func (p *CustomPusher) Send(ctx context.Context, cfg Config, _ string, body map[
 	bodyBytes, _ := io.ReadAll(io.LimitReader(resp.Body, maxCustomResponseBytes))
 	upstreamResp := strings.TrimSpace(string(bodyBytes))
 
-	if resp.StatusCode < 200 || resp.StatusCode >= 300 { //nolint:mnd
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
 		return upstreamResp, fmt.Errorf("custom: http status %s", resp.Status)
 	}
 

backend/plugins/domain/message_gateway/push/telegram.go

@@ -34,8 +34,6 @@ type telegramErrorResponse struct {
 }
 
 // Send 执行 Telegram 消息发送
-//
-//nolint:cyclop
 func (p *TelegramPusher) Send(ctx context.Context, cfg Config, target string, body map[string]any, template string, _ map[string]any) (string, error) {
 	if cfg.Secret == "" {
 		return "", errors.New("telegram: Bot Token (Secret) is required")

backend/plugins/domain/message_gateway/service/push.go

@@ -899,8 +899,6 @@ type EventTrigger struct{}
 var DefaultTrigger = &EventTrigger{}
 
 // Trigger receives event metadata and processes the event notification dispatch asynchronously.
-//
-//nolint:contextcheck
 func (t *EventTrigger) Trigger(ctx context.Context, meta model.EventMetadata, body map[string]any) {
 	asyncCtx := context.WithoutCancel(ctx)
 	util.Go(func() {

backend/plugins/domain/upload/handler/routers.go

@@ -55,8 +55,6 @@ type batchDownloadRequest struct {
 // @Failure 401 {object} response.Any "未登录"
 // @Failure 500 {object} response.Any "内部错误"
 // @Router /api/v1/upload [post]
-//
-//nolint:revive
 func UploadFile(c *gin.Context) {
 	c.Header("X-Content-Type-Options", "nosniff")
 	c.Header("Content-Security-Policy", "sandbox")

backend/plugins/domain/upload/task/storage_migration.go

@@ -108,7 +108,6 @@ func (h *MigrationHandler) Execute(ctx context.Context, payload []byte) (*contra
 			_ = cache.Delete(cleanupCtx, lockKey)
 		}()
 
-		//nolint:contextcheck,gosec
 		util.Go(func() {
 			ticker := time.NewTicker(renewalInterval)
 			defer ticker.Stop()
@@ -116,6 +115,7 @@ func (h *MigrationHandler) Execute(ctx context.Context, payload []byte) (*contra
 				select {
 				case <-ticker.C:
 					renewCtx, cancel := context.WithTimeout(context.Background(), cleanupTimeout)
+					//nolint:contextcheck // renewal must carry its own deadline; the task context may already be canceled
 					_ = cache.Set(renewCtx, lockKey, "locked", time.Hour)
 					cancel()
 				case <-stopRenewal:

backend/plugins/domain/user/errs.go

@@ -20,7 +20,7 @@ const (
 	errPasswordEncryptFailed = "密码加密失败"
 	//nolint:gosec // error message, not hardcoded credentials
 	errPasswordUpdateFailed = "密码更新失败"
-	//nolint:gosec // error message, not hardcoded credentials
+	// error message, not hardcoded credentials
 	errPasswordEmpty = "password cannot be empty"
 )
 
@@ -35,7 +35,7 @@ const (
 	errAdminCannotDelete    = "管理员账号无法被删除"
 	errCannotDeleteSelf     = "不能删除当前登录用户"
 	errServiceUsernameEmpty = "user: username cannot be empty"
-	//nolint:gosec // error message, not hardcoded credentials
+	// error message, not hardcoded credentials
 	errServiceOldPasswordIncorrect = "user: incorrect old password"
 	//nolint:gosec // error message, not hardcoded credentials
 	errServicePasswordTooShort = "密码长度至少为 8 位"