fix(lint): resolve 20 gocritic, eslint, and type safety issues

Backend (Go):
- Add named return parameters for improved readability
- Modernize octal literals (0755 → 0o755, 0644 → 0o644)
- Replace nil with http.NoBody in test requests (3 instances)
- Add error handling for rows.Close() in test helper
- Close HTTP response bodies in network tests (3 instances)

Frontend (React/TypeScript):
- Add Fast Refresh export suppressions for UI components
- Replace 'any' types with proper TypeScript types (6 instances)
- Add missing useEffect dependency (calculateScore)
- Remove unused variable in Playwright test

Testing:
- Backend coverage: 87.3% (threshold: 85%)
- Frontend coverage: 87.75% (threshold: 85%)
- All tests passing with race detection
- Zero type errors

Security:
- CodeQL scans: Zero HIGH/CRITICAL findings
- Trivy scan: Zero vulnerabilities
- Pre-commit hooks: All passing

backend/internal/api/handlers/additional_handlers_test.go

@@ -48,7 +48,7 @@ func TestFeatureFlagsHandler_GetFlags_FromShortEnv(t *testing.T) {
 	defer os.Unsetenv("CERBERUS_ENABLED")
 
 	w := httptest.NewRecorder()
-	req := httptest.NewRequest(http.MethodGet, "/flags", nil)
+	req := httptest.NewRequest(http.MethodGet, "/flags", http.NoBody)
 	router.ServeHTTP(w, req)
 
 	assert.Equal(t, http.StatusOK, w.Code)
@@ -106,7 +106,7 @@ func TestDomainHandler_List_Additional(t *testing.T) {
 	require.NoError(t, db.Create(&domain2).Error)
 
 	w := httptest.NewRecorder()
-	req := httptest.NewRequest(http.MethodGet, "/domains", nil)
+	req := httptest.NewRequest(http.MethodGet, "/domains", http.NoBody)
 	router.ServeHTTP(w, req)
 
 	assert.Equal(t, http.StatusOK, w.Code)
@@ -129,7 +129,7 @@ func TestDomainHandler_List_Empty_Additional(t *testing.T) {
 	router.GET("/domains", handler.List)
 
 	w := httptest.NewRecorder()
-	req := httptest.NewRequest(http.MethodGet, "/domains", nil)
+	req := httptest.NewRequest(http.MethodGet, "/domains", http.NoBody)
 	router.ServeHTTP(w, req)
 
 	assert.Equal(t, http.StatusOK, w.Code)

backend/internal/api/handlers/coverage_helpers_test.go

@@ -298,11 +298,11 @@ func TestCrowdsecHandler_ExportConfig(t *testing.T) {
 
 	tmpDir := t.TempDir()
 	configDir := filepath.Join(tmpDir, "crowdsec", "config")
-	require.NoError(t, os.MkdirAll(configDir, 0755))
+	require.NoError(t, os.MkdirAll(configDir, 0o755))
 
 	// Create test config file
 	configFile := filepath.Join(configDir, "config.yaml")
-	require.NoError(t, os.WriteFile(configFile, []byte("test: config"), 0644))
+	require.NoError(t, os.WriteFile(configFile, []byte("test: config"), 0o644))
 
 	h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", tmpDir)
 

backend/internal/api/handlers/crowdsec_coverage_target_test.go

@@ -86,7 +86,7 @@ func (f *fakeExecWithOutput) Stop(ctx context.Context, configDir string) error {
 	return f.err
 }
 
-func (f *fakeExecWithOutput) Status(ctx context.Context, configDir string) (bool, int, error) {
+func (f *fakeExecWithOutput) Status(ctx context.Context, configDir string) (running bool, pid int, err error) {
 	return false, 0, f.err
 }
 

backend/internal/api/handlers/testdb.go

@@ -100,7 +100,11 @@ func OpenTestDBWithMigrations(t *testing.T) *gorm.DB {
 		// For SQLite, we can use the template's schema info
 		rows, err := tmpl.Raw("SELECT sql FROM sqlite_master WHERE type='table' AND sql IS NOT NULL").Rows()
 		if err == nil {
-			defer rows.Close()
+			defer func() {
+				if closeErr := rows.Close(); closeErr != nil {
+					t.Logf("warning: failed to close rows: %v", closeErr)
+				}
+			}()
 			for rows.Next() {
 				var sql string
 				if rows.Scan(&sql) == nil && sql != "" {