ci: detect more than one unformatted file in the gofmt check

[thanderoy]

What

The gofmt check in test.yml silently passes whenever more than one file is unformatted, so it has never enforced formatting in practice.

auth/.github/workflows/test.yml

Line 42 in 2399fe5

if [ ! -z $(gofmt -l .) ]

if [ ! -z $(gofmt -l .) ]

The command substitution is unquoted, so the file list word-splits into separate arguments to [:

unformatted files	test expression	[ exit	step result
none	[ ! -z ]	0	passes (correct)
one	[ ! -z a.go ]	0	fails (correct)
two or more	[ ! -z a.go b.go ]	2, binary operator expected	passes

With two or more files, [ never evaluates the expression — it errors on the unexpected second operand and exits non-zero, the if takes the false branch, and the step exits 0. The failure is invisible in the log unless you read the set -x trace closely, because the step is green.

As of 2399fe5, five files on master are unformatted and pass CI:

internal/api/oauthserver/service.go
internal/api/provider/custom_oauth_claims_test.go
internal/api/provider/provider.go
internal/api/settings.go
internal/conf/confload/confload.go

How

Two commits, separable on purpose:

1. ci: detect more than one unformatted file in the gofmt check - quotes the substitution so the list stays one word, and uses -n rather than ! -z.
2. ci: run make format - the five files above, so the now-working check passes on this branch.

The check has to be fixed and the tree formatted in the same PR: fixing the check alone makes CI fail on the PR that fixes it.

Verified: gofmt -s -l . is empty, go build ./..., go vet ./... and staticcheck are clean, and the tests for the touched packages (internal/api/provider, internal/conf/...) pass.

Notes for review

• I also added -s to the check. The check ran plain gofmt -l, while its own error message and the format make target both specify gofmt -s -w. It was checking something narrower than it asked for.
• The second commit touches code I didn't write. It is make format output with no hand edits just struct field alignment, plus one binary expression spacing change in custom_oauth_claims_test.go. git diff -w on that commit is empty, and the diffstat is symmetric (37 insertions, 37 deletions). It should be reviewable at a glance, and is easy to drop and regenerate if it conflicts with anything in flight.
• The same unquoted pattern doesn't appear elsewhere in .github/workflows/.