Bump go to 1.26, update dependencies and CI, fix the e2e workflow

[paskal]

Routine maintenance: go directive, dependencies, workflow permissions and action versions, plus the playwright move that gets the e2e workflow running again.

Go and dependencies. The go directive moves to 1.26.0, with matching go-version in all three workflows, dependencies are updated and re-vendored. go fix ./app/... produced no changes.

Linter. golangci-lint v2.7.2 cannot load a module targeting go 1.26 (the Go language version (go1.25) used to build golangci-lint is lower than the targeted Go version (1.26.0)), so the pinned version moves to v2.12.2. That version reports 13 issues on the current code, triaged rather than suppressed wholesale:

• goconst (6). The occurrence counts come almost entirely from test files: https appears 4 times in production code and 43 across the package, message and exp twice each outside the constants themselves. The config already excludes goconst from test files, so ignore-tests: true makes the counting match that intent. The alternative, reusing msgKey/expKey for an API response key and a URL path segment, would conflate three different things that happen to share a spelling.
• gosec G124 in tests. These are request cookies built with req.AddCookie, where Secure, HttpOnly and SameSite have no meaning. Excluded by path, in the same style as the existing G101 exclusion for e2e.
• gosec G124 in auth.go and web.go. The session cookie sets Secure from the configured protocol because plain http is supported for local runs, and the theme cookie is deliberately readable from JS. Both carry a nolint with the reason.
• gosec G118. The shutdown deadline cannot derive from the context whose cancellation triggered the shutdown.
• gosec G705 (2). One path writes base64url ciphertext as text/plain, the other serves an application/octet-stream attachment; nosniff is set for both by the security headers middleware.
• nolintlint. gosec no longer reports the base62 index expression, so its nolint directive is stale and removed.

Workflows. build was the only workflow without a permissions block and now has permissions: {contents: read}. checkout, setup-go and cache move to their current majors.

playwright and the e2e workflow. The suite has been failing since 1 July for two independent reasons, both fixed here.

The upstream repository was renamed from playwright-community/playwright-go to mxschmitt/playwright-go and the module path moved with it, so every tag from v0.6100.0 on declares a path that cannot be resolved under the old import. Installing the CLI from @latest therefore fails before any test runs:

module declares its path as: github.com/mxschmitt/playwright-go
        but was required as: github.com/playwright-community/playwright-go

Staying on the old path is not an option either: up to v0.5200.1 the driver is downloaded from playwright.azureedge.net and its two mirrors, and all three now return 404. That is what the e2e job hits once the module error is out of the way. Current versions take playwright-core from the npm registry instead, so the download works again.

The dependency therefore moves to github.com/mxschmitt/playwright-go v0.6201.1, and the install steps use the version selected in go.mod rather than @latest. The full e2e suite passes locally against it.

TestTheme_Toggle needed one change to survive: the toggle answers with HX-Refresh, and the test waited for #message, which is present both before and after the reload, so the assertion could read the pre-reload document and see no data-theme. It now polls the attribute until it changes. The cache step also keeps ~/.cache/ms-playwright-go, which the newer version populates separately from the browsers.

Unit tests, the e2e suite and golangci-lint v2.12.2 all pass locally.