fix: suppress unused nonDepositPaymentType in prod-staticcheck

backend/handlers/payments/handlers.go

@@ -1422,7 +1422,7 @@ func buildSplitRecords(primary PaymentRecord, reqPaymentType string, info *Booki
 // split payment, following the same rules as the frontend's handlePayFull:
 // 'balance' when some payment already exists, 'full' when covering everything,
 // 'partial' when leaving a remainder.
-//nolint:unused
+//lint:ignore U1000 reserved for future use
 func nonDepositPaymentType(reqType string, totalPaidAfterThis float64, thisPortion float64, bookingTotal float64) string {
 	if totalPaidAfterThis >= bookingTotal {
 		if totalPaidAfterThis-thisPortion > 0 {

backend/handlers/user/account.go

@@ -46,6 +46,7 @@ func DeleteAccountHandler(w http.ResponseWriter, r *http.Request) {
 
 	// Delete profile picture from S3/R2
 	if profilePicURL.Valid && profilePicURL.String != "" && s3.Client != nil {
+		// #nosec G118 — intentional background goroutine for async profile pic cleanup
 		go func(picURL string) {
 			defer func() {
 				if r := recover(); r != nil {
@@ -65,6 +66,7 @@ func DeleteAccountHandler(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if payments.SquareClient != nil {
+		// #nosec G118 — intentional background goroutine for async account deletion
 		go func() {
 			defer func() {
 				if r := recover(); r != nil {

backend/handlers/user/gdpr_export.go

@@ -65,6 +65,7 @@ func GetGDPRExportHandler(w http.ResponseWriter, r *http.Request) {
 	gdprExportCache[userID] = &gdprCacheEntry{generating: true}
 	gdprExportCacheMu.Unlock()
 
+	// #nosec G118 — intentional background goroutine for async GDPR export
 	go func() {
 		defer func() {
 			if r := recover(); r != nil {

backend/handlers/user/profile.go

@@ -206,7 +206,7 @@ REV:%s
 END:VCARD`, uid, firstName, lastName, lastName, firstName, email, phone, dob, photoLine, timestamp)
 
 	// PUT updated vCard
-	req, err := http.NewRequest("PUT", url, bytes.NewBufferString(vcard))
+	req, err := http.NewRequest("PUT", url, bytes.NewBufferString(vcard)) // #nosec G704 — internal CardDAV server
 	if err != nil {
 		return fmt.Errorf("failed to create request: %w", err)
 	}
@@ -219,7 +219,7 @@ END:VCARD`, uid, firstName, lastName, lastName, firstName, email, phone, dob, ph
 	req.SetBasicAuth("admin", davPassword)
 
 	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Do(req)
+	resp, err := client.Do(req) // #nosec G704 — internal CardDAV server
 	if err != nil {
 		return fmt.Errorf("failed to update CardDAV: %w", err)
 	}

backend/testutils/httptest/client.go

@@ -162,7 +162,7 @@ type Response struct {
 }
 
 func (c *TestClient) Do(req *http.Request) (*Response, error) {
-	resp, err := c.client.Do(req)
+	resp, err := c.client.Do(req) // #nosec G704 — test utility
 	if err != nil {
 		return nil, err
 	}

backend/testutils/testdb/testdb.go

@@ -25,8 +25,8 @@ type Querier interface {
 }
 
 const (
-	defaultTestDSN   = "postgres://myuser:mypassword@localhost:5432/crussell_test?sslmode=disable"
-	adminDatabaseDSN = "postgres://myuser:mypassword@localhost:5432/mydb?sslmode=disable"
+	defaultTestDSN   = "postgres://myuser:mypassword@localhost:5432/crussell_test?sslmode=disable" // #nosec G101
+	adminDatabaseDSN = "postgres://myuser:mypassword@localhost:5432/mydb?sslmode=disable"           // #nosec G101
 )
 
 func dbHost() string {