Lint: fix real int-truncation bug; document intentional gosec findings

- TransportPool configKey: write conn-count ints verbatim (strconv) instead of
  byte() truncation — a config value >=256 previously truncated and made two
  distinct configs collide on one key, silently sharing a transport with the
  wrong settings (real fix, gosec G115).
- Document design-intentional gosec findings with //nolint:gosec + rationale:
  G117 (clients_secret intentionally marshaled into stored creds JSON),
  G704 (tokenURL is the trusted discovery endpoint), G124 (delete/test cookie,
  Secure set conditionally), G118 (long-lived background refresh) and pool
  utils short-ID rune, testutil mock server redirects.

Result: full-tree golangci-lint now reports 0 issues (was ~12). Build, vet,
and the full test suite remain green.

dynamic_client_registration.go

@@ -374,7 +374,7 @@ func (r *DynamicClientRegistrar) saveCredentialsToStore(ctx context.Context, res
 func (r *DynamicClientRegistrar) saveCredentials(resp *ClientRegistrationResponse) error {
 	filePath := r.credentialsFilePath()
 
-	data, err := json.MarshalIndent(resp, "", "  ")
+	data, err := json.MarshalIndent(resp, "", "  ") //nolint:gosec // registration response incl. client_secret is the API output
 	if err != nil {
 		return fmt.Errorf("failed to marshal credentials: %w", err)
 	}

helpers.go

@@ -163,7 +163,7 @@ func (t *TraefikOidc) exchangeTokens(ctx context.Context, grantType string, code
 		data.Set("client_secret", t.clientSecret)
 	}
 
-	req, err := http.NewRequestWithContext(ctx, "POST", tokenURL, strings.NewReader(data.Encode()))
+	req, err := http.NewRequestWithContext(ctx, "POST", tokenURL, strings.NewReader(data.Encode())) //nolint:gosec // tokenURL is the operator-trusted discovery endpoint (metadataMu)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create token request: %w", err)
 	}
@@ -172,7 +172,7 @@ func (t *TraefikOidc) exchangeTokens(ctx context.Context, grantType string, code
 		setOAuthBasicAuth(req, t.clientID, t.clientSecret)
 	}
 
-	resp, err := client.Do(req)
+	resp, err := client.Do(req) //nolint:gosec // req above targets the trusted tokenURL
 	if err != nil {
 		return nil, fmt.Errorf("failed to exchange tokens: %w", err)
 	}

internal/dcrstorage/file.go

@@ -78,7 +78,7 @@ func (s *FileStore) Save(ctx context.Context, providerURL string, creds *ClientR
 		return fmt.Errorf("failed to create credentials directory: %w", err)
 	}
 
-	data, err := json.MarshalIndent(creds, "", "  ")
+	data, err := json.MarshalIndent(creds, "", "  ") //nolint:gosec // ClientSecret must be persisted; creds are the feature's output
 	if err != nil {
 		return fmt.Errorf("failed to marshal credentials: %w", err)
 	}

internal/dcrstorage/redis.go

@@ -86,7 +86,7 @@ func (s *RedisStore) Save(ctx context.Context, providerURL string, creds *Client
 	}
 
 	// Serialize credentials to JSON for storage
-	data, err := json.Marshal(creds)
+	data, err := json.Marshal(creds) //nolint:gosec // secret intentionally serialized for Redis storage
 	if err != nil {
 		return fmt.Errorf("failed to marshal credentials: %w", err)
 	}

internal/pool/transport.go

@@ -5,6 +5,7 @@ import (
 	"crypto/tls"
 	"net"
 	"net/http"
+	"strconv"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -246,9 +247,15 @@ func (p *TransportPool) configKey(config TransportConfig) string {
 	sb := Get().GetStringBuilder()
 	defer Get().PutStringBuilder(sb)
 
-	sb.WriteByte(byte(config.MaxConnsPerHost))
-	sb.WriteByte(byte(config.MaxIdleConnsPerHost))
-	sb.WriteByte(byte(config.MaxIdleConns))
+	// Write the int fields verbatim, not byte()s: a config value >=256 would
+	// otherwise truncate and make two distinct configs collide on one key,
+	// silently sharing a single transport with the wrong settings.
+	sb.WriteString(strconv.Itoa(config.MaxConnsPerHost))
+	sb.WriteByte('|')
+	sb.WriteString(strconv.Itoa(config.MaxIdleConnsPerHost))
+	sb.WriteByte('|')
+	sb.WriteString(strconv.Itoa(config.MaxIdleConns))
+	sb.WriteByte('|')
 	if config.ForceHTTP2 {
 		sb.WriteByte(1)
 	} else {

internal/pool/utils.go

@@ -14,7 +14,7 @@ func BuildSessionName(baseName string, index int) string {
 	sb.WriteRune('_')
 	// Efficient int to string conversion
 	if index < 10 {
-		sb.WriteRune('0' + rune(index))
+		sb.WriteRune('0' + rune(index)) //nolint:gosec // index is bounded by the short alphabet size
 	} else {
 		sb.WriteString(intToString(index))
 	}

internal/testutil/servers/oidc.go

@@ -279,7 +279,7 @@ func (s *OIDCServer) handleAuthorize(w http.ResponseWriter, r *http.Request) {
 	}
 
 	redirectURL := fmt.Sprintf("%s?code=test-auth-code&state=%s", redirectURI, state)
-	http.Redirect(w, r, redirectURL, http.StatusFound)
+	http.Redirect(w, r, redirectURL, http.StatusFound) //nolint:gosec // mock IdP redirects to its configured (trusted) endpoint
 }
 
 func (s *OIDCServer) handleUserinfo(w http.ResponseWriter, r *http.Request) {
@@ -342,7 +342,7 @@ func (s *OIDCServer) handleLogout(w http.ResponseWriter, r *http.Request) {
 			http.Error(w, "invalid post_logout_redirect_uri", http.StatusBadRequest)
 			return
 		}
-		http.Redirect(w, r, postLogoutRedirect, http.StatusFound)
+		http.Redirect(w, r, postLogoutRedirect, http.StatusFound) //nolint:gosec // mock IdP post-logout redirect
 		return
 	}
 

internal/testutil/suite.go

@@ -72,7 +72,7 @@ func (s *OIDCSuite) NewRequest(method, path string) *http.Request {
 // NewRequestWithCookie creates a request with a session cookie
 func (s *OIDCSuite) NewRequestWithCookie(method, path, cookieName, cookieValue string) *http.Request {
 	req := s.NewRequest(method, path)
-	req.AddCookie(&http.Cookie{
+	req.AddCookie(&http.Cookie{ //nolint:gosec // test cookie on an httptest request
 		Name:  cookieName,
 		Value: cookieValue,
 	})

refresh_coordinator.go

@@ -229,7 +229,7 @@ func (rc *RefreshCoordinator) CoordinateRefresh(
 
 	if isNew {
 		// We created a new operation, so we need to execute it
-		go rc.executeRefreshAsync(operation, sessionID, tokenHash, refreshFunc)
+		go rc.executeRefreshAsync(operation, sessionID, tokenHash, refreshFunc) //nolint:gosec // long-lived background refresh intentionally uses a background context
 	} else {
 		// Joined existing operation - this is a deduplicated request
 		atomic.AddInt64(&rc.metrics.deduplicatedRequests, 1)

session.go

@@ -1007,7 +1007,7 @@ func (sm *SessionManager) CleanupOldCookies(w http.ResponseWriter, r *http.Reque
 						continue
 					}
 
-					deleteCookie := &http.Cookie{
+					deleteCookie := &http.Cookie{ //nolint:gosec // delete cookie sets Secure conditionally on the request proto
 						Name:     cookie.Name,
 						Value:    "",
 						Path:     "/",