autoresearch iter 22: delete lint suppressions that suppress nothing

24 of the 96 nolint directives were dead: they covered findings that no
longer exist. A stale suppression is not inert — it silently claims any
future finding for that linter in that scope, so a real problem raised
there would vanish without anyone noticing. Explanatory prose was kept as
ordinary comments.

Two directives proved load-bearing under the project gate even though
nolintlint reported them unused, and removing them exposed verified
contextcheck false positives: App.Run does forward a sigCtx derived from
the caller's context to Start, and the migration lock renewal must keep
its own deadline because the task context may already be canceled. Both
were restored, narrowed to the live linter, and given the reason the
originals lacked.

backend/plugins/domain/user/errs.go

@@ -20,7 +20,7 @@ const (
 	errPasswordEncryptFailed = "密码加密失败"
 	//nolint:gosec // error message, not hardcoded credentials
 	errPasswordUpdateFailed = "密码更新失败"
-	//nolint:gosec // error message, not hardcoded credentials
+	// error message, not hardcoded credentials
 	errPasswordEmpty = "password cannot be empty"
 )
 
@@ -35,7 +35,7 @@ const (
 	errAdminCannotDelete    = "管理员账号无法被删除"
 	errCannotDeleteSelf     = "不能删除当前登录用户"
 	errServiceUsernameEmpty = "user: username cannot be empty"
-	//nolint:gosec // error message, not hardcoded credentials
+	// error message, not hardcoded credentials
 	errServiceOldPasswordIncorrect = "user: incorrect old password"
 	//nolint:gosec // error message, not hardcoded credentials
 	errServicePasswordTooShort = "密码长度至少为 8 位"