fix: suppress unused nonDepositPaymentType in prod-staticcheck

backend/handlers/user/account.go

@@ -46,6 +46,7 @@ func DeleteAccountHandler(w http.ResponseWriter, r *http.Request) {
 
 	// Delete profile picture from S3/R2
 	if profilePicURL.Valid && profilePicURL.String != "" && s3.Client != nil {
+		// #nosec G118 — intentional background goroutine for async profile pic cleanup
 		go func(picURL string) {
 			defer func() {
 				if r := recover(); r != nil {
@@ -65,6 +66,7 @@ func DeleteAccountHandler(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if payments.SquareClient != nil {
+		// #nosec G118 — intentional background goroutine for async account deletion
 		go func() {
 			defer func() {
 				if r := recover(); r != nil {

backend/handlers/user/gdpr_export.go

@@ -65,6 +65,7 @@ func GetGDPRExportHandler(w http.ResponseWriter, r *http.Request) {
 	gdprExportCache[userID] = &gdprCacheEntry{generating: true}
 	gdprExportCacheMu.Unlock()
 
+	// #nosec G118 — intentional background goroutine for async GDPR export
 	go func() {
 		defer func() {
 			if r := recover(); r != nil {

backend/handlers/user/profile.go

@@ -206,7 +206,7 @@ REV:%s
 END:VCARD`, uid, firstName, lastName, lastName, firstName, email, phone, dob, photoLine, timestamp)
 
 	// PUT updated vCard
-	req, err := http.NewRequest("PUT", url, bytes.NewBufferString(vcard))
+	req, err := http.NewRequest("PUT", url, bytes.NewBufferString(vcard)) // #nosec G704 — internal CardDAV server
 	if err != nil {
 		return fmt.Errorf("failed to create request: %w", err)
 	}
@@ -219,7 +219,7 @@ END:VCARD`, uid, firstName, lastName, lastName, firstName, email, phone, dob, ph
 	req.SetBasicAuth("admin", davPassword)
 
 	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Do(req)
+	resp, err := client.Do(req) // #nosec G704 — internal CardDAV server
 	if err != nil {
 		return fmt.Errorf("failed to update CardDAV: %w", err)
 	}