fix: resolve unparam lint errors in server build

- Remove unused `ver` param from handleHealth and handleInfo (version
  was intentionally removed from unauthenticated endpoints per C-2)
- Rename decodeBase64Loose to validateBase64Loose returning only error,
  matching actual usage (all callers only validate, never use the bytes)

Server/api/router.go

@@ -46,7 +46,7 @@ func NewRouter(cfg *config.Config, database *db.DB, ver string, logBuf *admin.Ri
 	// Health check — unauthenticated, no versioning prefix.
 	// The online user count callback is set after hub creation below.
 	var getOnlineUsers func() int
-	r.Get("/health", handleHealth(ver, func() int {
+	r.Get("/health", handleHealth(func() int {
 		if getOnlineUsers != nil {
 			return getOnlineUsers()
 		}
@@ -64,13 +64,13 @@ func NewRouter(cfg *config.Config, database *db.DB, ver string, logBuf *admin.Ri
 
 	// Versioned API routes.
 	r.Route("/api/v1", func(r chi.Router) {
-		r.Get("/health", handleHealth(ver, func() int {
+		r.Get("/health", handleHealth(func() int {
 			if getOnlineUsers != nil {
 				return getOnlineUsers()
 			}
 			return 0
 		}))
-		r.Get("/info", handleInfo(cfg, ver))
+		r.Get("/info", handleInfo(cfg))
 	})
 
 	// Load (or auto-generate) the AES-256 key for TOTP secret encryption (M1).
@@ -239,7 +239,7 @@ type infoResponse struct {
 	Name string `json:"name"`
 }
 
-func handleHealth(ver string, getOnlineUsers func() int) http.HandlerFunc {
+func handleHealth(getOnlineUsers func() int) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		// C-2: Version removed from unauthenticated health endpoint to prevent
 		// server fingerprinting. Version is available on the authenticated
@@ -252,7 +252,7 @@ func handleHealth(ver string, getOnlineUsers func() int) http.HandlerFunc {
 	}
 }
 
-func handleInfo(cfg *config.Config, ver string) http.HandlerFunc {
+func handleInfo(cfg *config.Config) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		// C-2: Version removed from unauthenticated info endpoint.
 		writeJSON(w, http.StatusOK, infoResponse{

Server/ws/voice_e2ee.go

@@ -5,16 +5,18 @@ import (
 	"encoding/base64"
 )
 
-// decodeBase64Loose accepts both padded (StdEncoding) and unpadded (RawStdEncoding)
-// standard-alphabet base64. ECDH public keys exported from WebCrypto omit '='
-// padding; we accept both forms to avoid breaking existing clients.
+// validateBase64Loose checks that s is valid padded (StdEncoding) or unpadded
+// (RawStdEncoding) standard-alphabet base64. ECDH public keys exported from
+// WebCrypto omit '=' padding; we accept both forms to avoid breaking existing
+// clients.
 // Note: URL-safe base64 (alphabet '-_') is not accepted; clients must use the
 // standard alphabet ('+/').
-func decodeBase64Loose(s string) ([]byte, error) {
-	if b, err := base64.StdEncoding.DecodeString(s); err == nil {
-		return b, nil
+func validateBase64Loose(s string) error {
+	if _, err := base64.StdEncoding.DecodeString(s); err == nil {
+		return nil
 	}
-	return base64.RawStdEncoding.DecodeString(s)
+	_, err := base64.RawStdEncoding.DecodeString(s)
+	return err
 }
 
 // updateKeyHolder scans connected clients to find the one with the lowest
@@ -96,7 +98,7 @@ func handleVoiceE2EEAnnounceV2(_ context.Context, cmd Command, info ClientInfo,
 	if len(pubKey) > 128 {
 		return Result{Error: ClientError{Code: ErrCodeBadPayload, Message: "public_key too large"}}
 	}
-	if _, err := decodeBase64Loose(pubKey); err != nil {
+	if err := validateBase64Loose(pubKey); err != nil {
 		return Result{Error: ClientError{Code: ErrCodeBadPayload, Message: "public_key is not valid base64"}}
 	}
 
@@ -143,10 +145,10 @@ func handleVoiceE2EEOfferV2(_ context.Context, cmd Command, info ClientInfo, dep
 	if len(encKey) > 1024 || len(iv) > 128 {
 		return Result{Error: ClientError{Code: ErrCodeBadPayload, Message: "encrypted_key or iv too large"}}
 	}
-	if _, err := decodeBase64Loose(encKey); err != nil {
+	if err := validateBase64Loose(encKey); err != nil {
 		return Result{Error: ClientError{Code: ErrCodeBadPayload, Message: "encrypted_key is not valid base64"}}
 	}
-	if _, err := decodeBase64Loose(iv); err != nil {
+	if err := validateBase64Loose(iv); err != nil {
 		return Result{Error: ClientError{Code: ErrCodeBadPayload, Message: "iv is not valid base64"}}
 	}