fix(deps): bump the go toolchain to 1.26.6 for the stdlib advisories

[vineethkrishnan]

Problem

govulncheck fails on every PR against main. go.mod pinned go 1.26.5 and every workflow resolves its toolchain from that file (go-version-file: go.mod), so CI kept building against a standard library that now carries seven reachable advisories:

ID	Package	Example trace
GO-2026-6218	net/url	internal/infrastructure/backup/s3.go:252
GO-2026-6091	html/template	internal/presenters/cli/server_cmd.go:68
GO-2026-6090	crypto/tls	internal/infrastructure/mailer/mailer.go:166 and 5 others
GO-2026-6089	net/http	internal/presenters/cli/server_cmd.go:68
GO-2026-6088	encoding/xml	internal/infrastructure/backup/s3.go:205
GO-2026-5972	encoding/asn1	internal/application/clientcrypto/rsa.go:47
GO-2026-5026	net/http	internal/presenters/cli/server_cmd.go:99

All seven are standard library, all are fixed in go1.26.6, and no third-party module is implicated. Main was last green on 11 Aug (b3085e5); the advisories landed since, so this is failing on unrelated PRs such as #358.

Change

• go.mod: go 1.26.5 -> go 1.26.6
• Dockerfile: builder image golang:1.26.5-alpine -> golang:1.26.6-alpine

No dependency change, no source change, go.sum untouched.

Verification

Built and scanned locally against the bumped toolchain:

$ go version
go version go1.26.6 darwin/arm64
$ go build ./...          # clean
$ govulncheck ./...
No vulnerabilities found.
Your code is affected by 0 vulnerabilities.

Note for anyone building locally: your toolchain needs to be go1.26.6, which the default GOTOOLCHAIN=auto fetches on first build.