chore(backend): modernize to Go 1.26 and drop unmaintained deps

Backend/toolchain modernization with the mock format and HTTP/CLI API kept
byte-identical (guarded by new golden serialization tests + the venom suite).

- go 1.15 -> 1.26; io/ioutil -> io; rand.Seed -> math/rand/v2
- drop facebookgo/grace -> stdlib graceful shutdown (signal.NotifyContext +
  http.Server.Shutdown + errgroup), TLS preserved (SIGHUP restart dropped)
- drop namsral/flag -> stdlib flag (flag names + SMOCKER_* env preserved)
- drop logrus -> log/slog
- drop teris-io/shortid -> zero-dep crypto/rand base62 id (server/types/id.go)
- bump echo v4.15, sprig v3.3, objx v0.5, smarty/assertions v1.16, gopher-lua,
  gopher-luar, yaml.v3 v3.0.1 (goccy evaluated, rejected: alters output)
- golangci-lint config v1 -> v2 (Makefile pin 2.12.2), lint clean
- Dockerfile GO_VERSION 1.26
- add golden serialization tests locking the exact YAML/JSON mock format

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: gwleclerc

.golangci.yml

@@ -1,9 +1,36 @@
-linters-settings:
-  lll:
-    line-length: 150
+version: "2"
 
-issues:
-  exclude-rules:
-    - text: "exported type .* should have comment or be unexported"
-      linters:
-        - go-lint
+linters:
+  default: standard # errcheck, govet, ineffassign, staticcheck, unused
+  enable:
+    - lll
+    - misspell
+  settings:
+    lll:
+      line-length: 150
+    staticcheck:
+      checks:
+        - all
+        # ST1005: error strings should not be capitalized. Several validation errors are
+        # returned verbatim over the API (e.g. mock validation messages), so their exact,
+        # historically-capitalized wording is part of the observable contract and must not change.
+        - -ST1005
+        # ST1003 / ST1012: identifier naming conventions (e.g. Json vs JSON, ErrFoo error vars).
+        # These are long-standing internal identifiers; renaming them is pure churn with no
+        # effect on the mock format or HTTP API, so the existing names are kept for stability.
+        - -ST1003
+        - -ST1012
+  exclusions:
+    generated: lax
+    paths:
+      # node_modules ships a stray flatted/*.go; build is generated output. Neither is our code.
+      - node_modules
+      - build
+    presets:
+      - comments
+      - std-error-handling
+
+formatters:
+  enable:
+    - gofmt
+    - goimports

Dockerfile

@@ -1,4 +1,4 @@
-ARG GO_VERSION=1.22
+ARG GO_VERSION=1.26
 FROM golang:${GO_VERSION}-alpine AS build-backend
 RUN apk add --no-cache make
 ARG VERSION=snapshot

Makefile

@@ -34,7 +34,7 @@ REFLEX=$(GOPATH)/bin/reflex
 $(REFLEX):
 	go install github.com/cespare/reflex@latest
 
-GOLANGCILINTVERSION:=1.64.8
+GOLANGCILINTVERSION:=2.12.2
 GOLANGCILINT=$(GOPATH)/bin/golangci-lint
 $(GOLANGCILINT):
 	curl -fsSL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOPATH)/bin v$(GOLANGCILINTVERSION)

go.mod

@@ -1,36 +1,40 @@
 module github.com/smocker-dev/smocker
 
-go 1.15
+go 1.26
 
 require (
-	github.com/Masterminds/sprig/v3 v3.2.2
-	github.com/facebookgo/clock v0.0.0-20150410010913-600d898af40a // indirect
-	github.com/facebookgo/ensure v0.0.0-20200202191622-63f1cf65ac4c // indirect
-	github.com/facebookgo/freeport v0.0.0-20150612182905-d4adf43b75b9 // indirect
-	github.com/facebookgo/grace v0.0.0-20180706040059-75cf19382434
-	github.com/facebookgo/httpdown v0.0.0-20180706035922-5979d39b15c2 // indirect
-	github.com/facebookgo/stack v0.0.0-20160209184415-751773369052 // indirect
-	github.com/facebookgo/stats v0.0.0-20151006221625-1b76add642e4 // indirect
-	github.com/facebookgo/subset v0.0.0-20200203212716-c811ad88dec4 // indirect
-	github.com/konsorten/go-windows-terminal-sequences v1.0.2 // indirect
-	github.com/kr/pretty v0.1.0 // indirect
-	github.com/labstack/echo/v4 v4.7.0
-	github.com/layeh/gopher-json v0.0.0-20190114024228-97fed8db8427
-	github.com/mattn/go-colorable v0.1.12 // indirect
-	github.com/mitchellh/mapstructure v1.1.2 // indirect
-	github.com/mitchellh/reflectwalk v1.0.1 // indirect
-	github.com/namsral/flag v1.7.4-pre
-	github.com/sirupsen/logrus v1.4.2
-	github.com/smartystreets/assertions v1.0.1
-	github.com/stretchr/objx v0.2.0
-	github.com/teris-io/shortid v0.0.0-20171029131806-771a37caa5cf
+	github.com/Masterminds/sprig/v3 v3.3.0
+	github.com/labstack/echo/v4 v4.15.4
+	github.com/smarty/assertions v1.16.0
+	github.com/stretchr/objx v0.5.3
 	github.com/yuin/gluamapper v0.0.0-20150323120927-d836955830e7
-	github.com/yuin/gopher-lua v0.0.0-20191220021717-ab39c6098bdb
-	golang.org/x/crypto v0.0.0-20220307211146-efcb8507fb70 // indirect
-	golang.org/x/net v0.0.0-20220225172249-27dd8689420f // indirect
-	golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a
-	golang.org/x/sys v0.0.0-20220307203707-22a9840ba4d7 // indirect
+	github.com/yuin/gopher-lua v1.1.2
+	golang.org/x/sync v0.21.0
+	gopkg.in/yaml.v3 v3.0.1
+	layeh.com/gopher-json v0.0.0-20201124131017-552bb3c4c3bf
+	layeh.com/gopher-luar v1.0.11
+)
+
+require (
+	dario.cat/mergo v1.0.1 // indirect
+	github.com/Masterminds/goutils v1.1.1 // indirect
+	github.com/Masterminds/semver/v3 v3.3.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/huandu/xstrings v1.5.0 // indirect
+	github.com/labstack/gommon v0.5.0 // indirect
+	github.com/mattn/go-colorable v0.1.15 // indirect
+	github.com/mattn/go-isatty v0.0.22 // indirect
+	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/mapstructure v1.1.2 // indirect
+	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/shopspring/decimal v1.4.0 // indirect
+	github.com/spf13/cast v1.7.0 // indirect
+	github.com/valyala/bytebufferpool v1.0.0 // indirect
+	github.com/valyala/fasttemplate v1.2.2 // indirect
+	golang.org/x/crypto v0.53.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/text v0.38.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
 	gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 // indirect
-	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
-	layeh.com/gopher-luar v1.0.7
 )