ci: add golangci-lint config and fix formatting

- Add .golangci.yml with minimal linters (govet, ineffassign)
- Run gofmt -s and goimports on all files to fix formatting
- Disable fieldalignment and copylocks checks in govet

internal/encryption/encryption_test.go

@@ -9,11 +9,11 @@ import (
 func TestEncryptDecrypt(t *testing.T) {
 	// Test data
 	original := []byte("This is a secret database backup that needs encryption! 🔒")
-	
+
 	// Test with passphrase
 	t.Run("Passphrase", func(t *testing.T) {
 		var encrypted bytes.Buffer
-		
+
 		// Encrypt
 		writer, err := NewEncryptionWriter(&encrypted, EncryptionOptions{
 			Passphrase: "super-secret-password",
@@ -21,23 +21,23 @@ func TestEncryptDecrypt(t *testing.T) {
 		if err != nil {
 			t.Fatalf("Failed to create encryption writer: %v", err)
 		}
-		
+
 		if _, err := writer.Write(original); err != nil {
 			t.Fatalf("Failed to write data: %v", err)
 		}
-		
+
 		if err := writer.Close(); err != nil {
 			t.Fatalf("Failed to close writer: %v", err)
 		}
-		
+
 		t.Logf("Original size: %d bytes", len(original))
 		t.Logf("Encrypted size: %d bytes", encrypted.Len())
-		
+
 		// Verify encrypted data is different from original
 		if bytes.Contains(encrypted.Bytes(), original) {
 			t.Error("Encrypted data contains plaintext - encryption failed!")
 		}
-		
+
 		// Decrypt
 		reader, err := NewDecryptionReader(&encrypted, EncryptionOptions{
 			Passphrase: "super-secret-password",
@@ -45,30 +45,30 @@ func TestEncryptDecrypt(t *testing.T) {
 		if err != nil {
 			t.Fatalf("Failed to create decryption reader: %v", err)
 		}
-		
+
 		decrypted, err := io.ReadAll(reader)
 		if err != nil {
 			t.Fatalf("Failed to read decrypted data: %v", err)
 		}
-		
+
 		// Verify decrypted matches original
 		if !bytes.Equal(decrypted, original) {
 			t.Errorf("Decrypted data doesn't match original\nOriginal: %s\nDecrypted: %s",
 				string(original), string(decrypted))
 		}
-		
+
 		t.Log("✅ Encryption/decryption successful")
 	})
-	
+
 	// Test with direct key
 	t.Run("DirectKey", func(t *testing.T) {
 		key, err := GenerateKey()
 		if err != nil {
 			t.Fatalf("Failed to generate key: %v", err)
 		}
-		
+
 		var encrypted bytes.Buffer
-		
+
 		// Encrypt
 		writer, err := NewEncryptionWriter(&encrypted, EncryptionOptions{
 			Key: key,
@@ -76,15 +76,15 @@ func TestEncryptDecrypt(t *testing.T) {
 		if err != nil {
 			t.Fatalf("Failed to create encryption writer: %v", err)
 		}
-		
+
 		if _, err := writer.Write(original); err != nil {
 			t.Fatalf("Failed to write data: %v", err)
 		}
-		
+
 		if err := writer.Close(); err != nil {
 			t.Fatalf("Failed to close writer: %v", err)
 		}
-		
+
 		// Decrypt
 		reader, err := NewDecryptionReader(&encrypted, EncryptionOptions{
 			Key: key,
@@ -92,23 +92,23 @@ func TestEncryptDecrypt(t *testing.T) {
 		if err != nil {
 			t.Fatalf("Failed to create decryption reader: %v", err)
 		}
-		
+
 		decrypted, err := io.ReadAll(reader)
 		if err != nil {
 			t.Fatalf("Failed to read decrypted data: %v", err)
 		}
-		
+
 		if !bytes.Equal(decrypted, original) {
 			t.Errorf("Decrypted data doesn't match original")
 		}
-		
+
 		t.Log("✅ Direct key encryption/decryption successful")
 	})
-	
+
 	// Test wrong password
 	t.Run("WrongPassword", func(t *testing.T) {
 		var encrypted bytes.Buffer
-		
+
 		// Encrypt
 		writer, err := NewEncryptionWriter(&encrypted, EncryptionOptions{
 			Passphrase: "correct-password",
@@ -116,10 +116,10 @@ func TestEncryptDecrypt(t *testing.T) {
 		if err != nil {
 			t.Fatalf("Failed to create encryption writer: %v", err)
 		}
-		
+
 		writer.Write(original)
 		writer.Close()
-		
+
 		// Try to decrypt with wrong password
 		reader, err := NewDecryptionReader(&encrypted, EncryptionOptions{
 			Passphrase: "wrong-password",
@@ -127,12 +127,12 @@ func TestEncryptDecrypt(t *testing.T) {
 		if err != nil {
 			t.Fatalf("Failed to create decryption reader: %v", err)
 		}
-		
+
 		_, err = io.ReadAll(reader)
 		if err == nil {
 			t.Error("Expected decryption to fail with wrong password, but it succeeded")
 		}
-		
+
 		t.Logf("✅ Wrong password correctly rejected: %v", err)
 	})
 }
@@ -143,9 +143,9 @@ func TestLargeData(t *testing.T) {
 	for i := range original {
 		original[i] = byte(i % 256)
 	}
-	
+
 	var encrypted bytes.Buffer
-	
+
 	// Encrypt
 	writer, err := NewEncryptionWriter(&encrypted, EncryptionOptions{
 		Passphrase: "test-password",
@@ -153,19 +153,19 @@ func TestLargeData(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Failed to create encryption writer: %v", err)
 	}
-	
+
 	if _, err := writer.Write(original); err != nil {
 		t.Fatalf("Failed to write data: %v", err)
 	}
-	
+
 	if err := writer.Close(); err != nil {
 		t.Fatalf("Failed to close writer: %v", err)
 	}
-	
+
 	t.Logf("Original size: %d bytes", len(original))
 	t.Logf("Encrypted size: %d bytes", encrypted.Len())
 	t.Logf("Overhead: %.2f%%", float64(encrypted.Len()-len(original))/float64(len(original))*100)
-	
+
 	// Decrypt
 	reader, err := NewDecryptionReader(&encrypted, EncryptionOptions{
 		Passphrase: "test-password",
@@ -173,16 +173,16 @@ func TestLargeData(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Failed to create decryption reader: %v", err)
 	}
-	
+
 	decrypted, err := io.ReadAll(reader)
 	if err != nil {
 		t.Fatalf("Failed to read decrypted data: %v", err)
 	}
-	
+
 	if !bytes.Equal(decrypted, original) {
 		t.Errorf("Large data decryption failed")
 	}
-	
+
 	t.Log("✅ Large data encryption/decryption successful")
 }
 
@@ -192,43 +192,43 @@ func TestKeyGeneration(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Failed to generate key: %v", err)
 	}
-	
+
 	if len(key1) != KeySize {
 		t.Errorf("Key size mismatch: expected %d, got %d", KeySize, len(key1))
 	}
-	
+
 	// Generate another key and verify it's different
 	key2, err := GenerateKey()
 	if err != nil {
 		t.Fatalf("Failed to generate second key: %v", err)
 	}
-	
+
 	if bytes.Equal(key1, key2) {
 		t.Error("Generated keys are identical - randomness broken!")
 	}
-	
+
 	t.Log("✅ Key generation successful")
 }
 
 func TestKeyDerivation(t *testing.T) {
 	passphrase := "my-secret-passphrase"
 	salt1, _ := GenerateSalt()
-	
+
 	// Derive key twice with same salt - should be identical
 	key1 := DeriveKey(passphrase, salt1)
 	key2 := DeriveKey(passphrase, salt1)
-	
+
 	if !bytes.Equal(key1, key2) {
 		t.Error("Key derivation not deterministic")
 	}
-	
+
 	// Derive with different salt - should be different
 	salt2, _ := GenerateSalt()
 	key3 := DeriveKey(passphrase, salt2)
-	
+
 	if bytes.Equal(key1, key3) {
 		t.Error("Different salts produced same key")
 	}
-	
+
 	t.Log("✅ Key derivation successful")
 }