chore(lint): close 5 golangci-lint v2 findings surfaced by v2.1.0 release-gate Phase 1.3

Five golangci-lint v2 findings surfaced when running the v2.1.0 release
gate (auth-bundle-2 → master pre-flight). Each is mechanical:

1. govet/printf-style misuse — internal/auth/oidc/service_test.go used
   integer literal 501 in http.Error; switched to http.StatusNotImplemented.

2. staticcheck SA1019 — internal/auth/breakglass/reflect_helper_test.go
   referenced reflect.Ptr; the canonical name since Go 1.18 is
   reflect.Pointer.

3. staticcheck ST1020 — internal/repository/postgres/auth.go
   ActorRoleRepository.Revoke had a doc comment that did not begin with
   the method name. Prepended 'Revoke drops actor_roles rows.' to the
   comment so it now starts with the method name.

4. staticcheck ST1022 — internal/api/handler/auth_session_oidc.go
   DefaultBCLVerifierMaxAge docstring was attached to the DefaultBCLVerifier
   type docstring. Moved the const docstring directly above the const
   declaration, separated by a blank line.

5. unused — internal/auth/session/bench_test.go declared
   benchSessionMinSamples and never referenced it; the bench loop relies
   on Go's default b.N scaling. Replaced the const block with a comment
   describing the rationale.

Lint clean (golangci-lint v2.12.2 with the .golangci.yml config) on the
five edited packages.

internal/auth/breakglass/reflect_helper_test.go

@@ -11,7 +11,7 @@ import (
 // wire-leak the Argon2id hash. Test-only.
 func reflectJSONTag(v interface{}, fieldName string) string {
 	rv := reflect.ValueOf(v)
-	if rv.Kind() == reflect.Ptr {
+	if rv.Kind() == reflect.Pointer {
 		rv = rv.Elem()
 	}
 	if rv.Kind() != reflect.Struct {

internal/auth/oidc/service_test.go

@@ -290,7 +290,7 @@ func newMockIdPWithTB(t testing.TB) *mockIdP {
 	mux.HandleFunc("/authorize", func(w http.ResponseWriter, r *http.Request) {
 		// Tests call HandleCallback directly; this endpoint exists for
 		// completeness but the test never round-trips through it.
-		http.Error(w, "test fixture: not implemented", 501)
+		http.Error(w, "test fixture: not implemented", http.StatusNotImplemented)
 	})
 
 	idp.server = httptest.NewServer(mux)

internal/auth/session/bench_test.go

@@ -47,13 +47,11 @@ import (
 // The full Phase 14 result table lives at docs/operator/auth-benchmarks.md.
 // =============================================================================
 
-// benchSessionConfig caps b.N to keep the benchmark tractable; for
-// p99 we want at least ~1000 samples but not so many that the
-// benchmark takes >10s on a CI runner. Go's default benchmark scaling
-// already handles this.
-const (
-	benchSessionMinSamples = 1000
-)
+// Bench config: Go's default benchmark scaling caps b.N to keep the
+// benchmark tractable. For p99 we want at least ~1000 samples but not
+// so many that the benchmark takes >10s on a CI runner. We let the
+// runtime handle it rather than enforcing a const that lint can't
+// trace through to a use site.
 
 // setupBenchSession boots a session.Service with a warm in-memory
 // repo + a single active signing key, mints one session row, and