Handle cleanup errors and enable errcheck

[kilo666mj]

Completes gatekit's entry in the ERRCHECK_BACKLOG.md rollout. 47 findings — 29 in production paths, 18 in tests. Measured with --max-same-issues=0 --max-issues-per-linter=0, so this is the complete backlog, not golangci-lint's first diagnostic page.

Production follows the pattern already established in gatehub. A new unexported store/cleanup.go provides closeError, closeWithError and rollbackTransaction, so row, statement, transaction and database cleanup joins onto a named error return instead of being dropped. A rollback after a successful commit still reports sql.ErrTxDone as the expected outcome rather than a failure. Open joins its unwind close failures onto the error that caused the unwind.

Two judgement calls worth review:

• migrateLegacy keeps closing its rows explicitly before BeginTx rather than deferring. Reads and writes share the single writer connection (db.SetMaxOpenConns(1)), so holding the rows open until return would block the write it's about to make. Deferring here would have been the tidier-looking change and the wrong one.
• The proxy logs its close error rather than returning it — a served connection has nowhere to return one — and treats an already-closed peer (net.ErrClosed) as the normal case, not a fault. This matches sshgate.

Tests assert store and database cleanup, since a failed close means the database didn't shut down cleanly and, in the two places a test reopens the file, invalidates everything the reopen then asserts. Test-server encode failures are asserted too: a fixture that fails to encode leaves the test checking a body it never sent. Only net.Pipe and unixgram listener teardown is marked best-effort with _ =.

No public API changes — the named returns don't alter any signature's type.

Verified locally: go build, go vet, gofmt -l, go test ./... and go test -race ./... all pass, and golangci-lint v2.13.2 reports 0 issues under the repository's own config with errcheck enabled.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Kt6cL2BR1oWL7v6DtEgCCm