fix(lint): replace deferred rollback nolint with explicit error handling

internal/auth/store_postgres.go

@@ -435,7 +435,11 @@ func (s *PostgresStore) CreateAdminIfNone(ctx context.Context, user *User) (bool
 	// Rollback is a no-op after a successful Commit; on any earlier return
 	// it also releases the advisory lock. Matches the project convention
 	// (e.g. internal/config/store_postgres.go) for deferred rollback.
-	defer tx.Rollback(ctx) //nolint:errcheck
+	defer func() {
+		if rbErr := tx.Rollback(ctx); rbErr != nil {
+			_ = rbErr // rollback error intentionally discarded; Postgres logs rollback failures
+		}
+	}()
 
 	// Serialize against concurrent bootstrap calls and against the
 	// min-one-admin deferred trigger (see adminInvariantAdvisoryLockKey).

internal/config/store_postgres.go

@@ -2996,7 +2996,11 @@ func (s *PostgresStore) DeleteCloudAccount(ctx context.Context, id string) error
 	if err != nil {
 		return fmt.Errorf("failed to begin transaction: %w", err)
 	}
-	defer tx.Rollback(ctx) //nolint:errcheck
+	defer func() {
+		if rbErr := tx.Rollback(ctx); rbErr != nil {
+			_ = rbErr // rollback error intentionally discarded; Postgres logs rollback failures
+		}
+	}()
 
 	// Reset any linked approved registration first (explicit NULL so we don't
 	// rely on the FK's ON DELETE SET NULL behavior).
@@ -3304,7 +3308,11 @@ func (s *PostgresStore) SetPlanAccounts(ctx context.Context, planID string, acco
 	if err != nil {
 		return fmt.Errorf("failed to begin transaction: %w", err)
 	}
-	defer tx.Rollback(ctx) //nolint:errcheck
+	defer func() {
+		if rbErr := tx.Rollback(ctx); rbErr != nil {
+			_ = rbErr // rollback error intentionally discarded; Postgres logs rollback failures
+		}
+	}()
 
 	err = s.validatePlanAccountProvidersTx(ctx, tx, planID, accountIDs)
 	if err != nil {

internal/config/store_postgres_recommendations.go

@@ -28,7 +28,11 @@ func (s *PostgresStore) ReplaceRecommendations(ctx context.Context, collectedAt
 	if err != nil {
 		return fmt.Errorf("failed to begin tx: %w", err)
 	}
-	defer tx.Rollback(ctx) //nolint:errcheck
+	defer func() {
+		if rbErr := tx.Rollback(ctx); rbErr != nil {
+			_ = rbErr // rollback error intentionally discarded; Postgres logs rollback failures
+		}
+	}()
 
 	if _, err := tx.Exec(ctx, `DELETE FROM recommendations`); err != nil {
 		return fmt.Errorf("failed to wipe recommendations: %w", err)
@@ -75,7 +79,11 @@ func (s *PostgresStore) UpsertRecommendations(ctx context.Context, collectedAt t
 	if err != nil {
 		return fmt.Errorf("failed to begin tx: %w", err)
 	}
-	defer tx.Rollback(ctx) //nolint:errcheck
+	defer func() {
+		if rbErr := tx.Rollback(ctx); rbErr != nil {
+			_ = rbErr // rollback error intentionally discarded; Postgres logs rollback failures
+		}
+	}()
 
 	if err := insertRecommendationsBatched(ctx, tx, collectedAt, recs, true); err != nil {
 		return err