chore(lint): enable gosec and remediate findings

[rsclarke]

Summary

This PR enables gosec in golangci-lint and remediates all current security findings so the security linter runs cleanly in CI. The issue requested that gosec be active and that existing findings be fixed or explicitly justified; this change set satisfies that by fixing each reported finding in code and tests.

Changes

• Enable gosec in .golangci.yml by removing it from disabled linters and adding it to enabled linters.
• Handle db.Close() errors during initialization failure paths in storage.go.
• Replace lock polling jitter from math/rand with a crypto/rand-based helper in storage.go.
• Update tests to handle Close() and Unlock() errors instead of discarding them.
• Run and pass full CI checks locally via task ci.

Closes #13