fix(verify): close service-level typed-nil store + adapter-author guidance

[paskal]

Summary

Followups to #281 raised on the post-merge review. None blocking, all small.

#	Item	Where
1	Service-level typed-nil VerifConfirmationStoreFunc guard -- silently disabled replay protection for Opts{VerifConfirmationStore: VerifConfirmationStoreFunc(nil)}	auth.go, v2/auth.go (+ tests)
2	gofmt -w after the verifConfirmStoreO -> verifConfirmStoreOnce rename	auth.go, v2/auth.go
3	Unit test for scrubTokenFromRequest -- the defensive early-return was uncovered after #281	provider/verify_test.go, v2/provider/verify_test.go
4	Adapter-author godoc note on MarkUsed -- don't embed key in returned errors	provider/verify.go, v2/provider/verify.go

Item 1 in detail

The handler-level guard added in #281 round 2 (provider/verify.go LoginHandler) correctly normalises a typed-nil VerifConfirmationStoreFunc to no-store, but the Service-level check in AddVerifProvider was still:

if s.opts.VerifConfirmationStore != nil {
    s.verifConfirmStore = s.opts.VerifConfirmationStore
    return
}
s.verifConfirmStore = provider.NewInMemoryVerifStore()

A typed-nil VerifConfirmationStoreFunc is a non-nil interface wrapping a nil func, so it survives the != nil check, NewInMemoryVerifStore() is skipped, and at redemption time the handler-level guard then normalises the typed-nil to nil. Net effect: a user writing Opts{VerifConfirmationStore: VerifConfirmationStoreFunc(nil)} gets neither their func nor the default in-memory store, and replay protection is silently disabled.

Same shape as the *avatar.Proxy typed-nil case fixed in #286, with a different consequence (silent loss of protection rather than panic). The fix is the same shape applied one layer up:

s.verifConfirmStoreOnce.Do(func() {
    store := s.opts.VerifConfirmationStore
    if fn, ok := store.(provider.VerifConfirmationStoreFunc); ok && fn == nil {
        store = nil
    }
    if store != nil {
        s.verifConfirmStore = store
        return
    }
    s.verifConfirmStore = provider.NewInMemoryVerifStore()
})

Regression test TestService_AddVerifProvider_TypedNilStoreFuncFallsBackToDefault in both v1 and v2: writes var nilFn provider.VerifConfirmationStoreFunc; ConfirmationStore: nilFn, asserts verifConfirmStore is non-nil and is not the typed-nil func itself (i.e. the default fired).

Test

go test -race ./... green in both modules; golangci-lint run --enable-only=misspell ./... clean.

[coveralls]

Coverage Report for CI Build 25611934022

Coverage increased (+0.09%) to 85.291%

Details

• Coverage increased (+0.09%) from the base build.
• Patch coverage: 10 of 10 lines across 1 file are fully covered (100%).
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	3474
Covered Lines:	2963
Line Coverage:	85.29%
Coverage Strength:	8.07 hits per line

---

💛 - Coveralls

[umputun]

all 4 followups look good. Tests cover the typed-nil regression and scrubTokenFromRequest, v1/v2 mirror is right. LGTM.