fix(documents): update vendorHash after rebase and fix gosec lint

Update vendorHash for the rebased dependency set. Suppress gosec G115
(integer overflow) on two conversions that are guarded: entity ID is
validated positive before uint cast, and SizeBytes is clamped to
non-negative before uint64 cast.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: cpcloud

flake.nix

@@ -29,7 +29,7 @@
           inherit version;
           src = ./.;
           subPackages = [ "cmd/micasa" ];
-          vendorHash = pkgs.lib.fakeHash;
+          vendorHash = "sha256-JkhY04nP3aWuk7YvF3dkK4ZfRxGfdv7hgK0YlX4Dg5w=";
           env.CGO_ENABLED = 0;
           preCheck = ''
             export HOME="$(mktemp -d)"

internal/app/forms.go

@@ -728,12 +728,12 @@ func (m *Model) parseDocumentFormData() (data.Document, string, error) {
 			return data.Document{}, "", fmt.Errorf("linked record id is required")
 		}
 		parsed, err := data.ParseRequiredInt(entityIDText)
-		if err != nil {
+		if err != nil || parsed <= 0 {
 			return data.Document{}, "", fmt.Errorf(
 				"linked record id should be a positive whole number",
 			)
 		}
-		id := uint(parsed)
+		id := uint(parsed) //nolint:gosec // guarded by parsed > 0 above
 		entityID = &id
 	}
 

internal/app/tables.go

@@ -403,7 +403,10 @@ func documentRows(items []data.Document) ([]table.Row, []rowMeta, [][]cell) {
 				{Value: d.FileName, Kind: cellText},
 				{Value: displayDocumentKind(d.EntityKind), Kind: cellText},
 				{Value: ref, Kind: cellText},
-				{Value: humanize.IBytes(uint64(d.SizeBytes)), Kind: cellReadonly},
+				{
+					Value: humanize.IBytes(uint64(max(d.SizeBytes, 0))), //nolint:gosec // clamped
+					Kind:  cellReadonly,
+				},
 			},
 		}
 	})