more lint cleanup

.golangci.yml

···
           - errcheck
 
       # TODO: fix issues and remove these paths one by one
-      - path: cmd/credential-helper
-        linters:
-          - errcheck
 
 formatters:
   enable:

pkg/appview/handlers/device.go

···
 	}
 
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	tmpl.Execute(w, data)
+	if err := tmpl.Execute(w, data); err != nil {
+		http.Error(w, "failed to render template", http.StatusInternalServerError)
+		return
+	}
 }
 
 func (h *DeviceApprovalPageHandler) renderSuccess(w http.ResponseWriter, deviceName string) {
···
 	}
 
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	tmpl.Execute(w, data)
+	if err := tmpl.Execute(w, data); err != nil {
+		http.Error(w, "failed to render template", http.StatusInternalServerError)
+		return
+	}
 }
 
 func (h *DeviceApprovalPageHandler) renderError(w http.ResponseWriter, message string) {
···
 
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.WriteHeader(http.StatusBadRequest)
-	tmpl.Execute(w, data)
+	if err := tmpl.Execute(w, data); err != nil {
+		http.Error(w, "failed to render template", http.StatusInternalServerError)
+		return
+	}
 }
 
 func getClientIP(r *http.Request) string {

pkg/appview/jetstream/worker.go

···
 	})
 
 	// Set initial read deadline
-	conn.SetReadDeadline(time.Now().Add(90 * time.Second))
+	if err := conn.SetReadDeadline(time.Now().Add(90 * time.Second)); err != nil {
+		return fmt.Errorf("failed to set read deadline: %w", err)
+	}
 
 	// Create zstd decoder for decompressing messages
 	decoder, err := zstd.NewReader(nil)
···
 				}
 
 				// Send ping with write deadline
-				conn.SetWriteDeadline(time.Now().Add(10 * time.Second))
+				if err := conn.SetWriteDeadline(time.Now().Add(10 * time.Second)); err != nil {
+					slog.Warn("Jetstream failed to set write deadline", "error", err)
+					conn.Close()
+					return
+				}
 				if err := conn.WriteMessage(websocket.PingMessage, nil); err != nil {
 					slog.Warn("Jetstream failed to send ping", "error", err)
 					conn.Close()

pkg/appview/middleware/registry.go

···
 
 func init() {
 	// Register the name resolution middleware
-	registrymw.Register("atproto-resolver", initATProtoResolver)
+	if err := registrymw.Register("atproto-resolver", initATProtoResolver); err != nil {
+		panic("failed to register atproto-resolver middleware: " + err.Error())
+	}
 }
 
 // NamespaceResolver wraps a namespace and resolves names

pkg/appview/storage/proxy_blob_store.go

···
 	"io"
 	"log/slog"
 	"net/http"
+	"strconv"
 	"sync"
 	"time"
 
···
 	// Return a minimal descriptor with size from Content-Length if available
 	size := int64(0)
 	if contentLength := resp.Header.Get("Content-Length"); contentLength != "" {
-		fmt.Sscanf(contentLength, "%d", &size)
+		if parsed, err := strconv.ParseInt(contentLength, 10, 64); err == nil {
+			size = parsed
+		}
 	}
 
 	return distribution.Descriptor{