fix: the backup package checks or explicitly drops every error the linter flags

Closing a refused S3 response and a test file, and the fake bucket's
writes, now say they ignore the error on purpose; handler parameters the
tests don't use are named _.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/backup/s3.go

@@ -86,7 +86,7 @@ func (b Bucket) do(req *http.Request, payloadSHA256 string) (*http.Response, err
 		return nil, fmt.Errorf("%w: %s is unreachable: %v", ErrS3, req.URL.Host, err)
 	}
 	if resp.StatusCode/100 != 2 {
-		defer resp.Body.Close()
+		defer func() { _ = resp.Body.Close() }()
 		return nil, refusal(resp)
 	}
 	return resp, nil