chore: gofmt the tree, clear staticcheck, add a CI gofmt gate

Nine files had drifted from gofmt and nothing checked; nine staticcheck
findings were live (three dead symbols, capitalization, a redundant
Sprintf, two literal-to-conversion sites, a nil test context). Fix all
of them and make CI fail on unformatted Go so this cannot re-drift.

internal/api/api.go

@@ -674,10 +674,9 @@ func principalFromContext(ctx context.Context) *Principal {
 // #35); cross-replica bounding would need a shared store (out of scope for the
 // single-replica demo).
 type cooldownLimiter struct {
-	mu     sync.Mutex
-	now    func() time.Time
-	last   map[string]time.Time
-	window time.Duration
+	mu   sync.Mutex
+	now  func() time.Time
+	last map[string]time.Time
 }
 
 // allowed reports whether name may wake now WITHOUT recording the attempt. A