build: unify the gate so root make check covers the backend (closes #16)

Root `make check` only ever ran the frontend, so the "main is always
green" policy was satisfied vacuously: the Go backend could be entirely
broken and the root gate stayed green.

- The backend moves onto scripts-to-rule-them-all. Its test, lint, fmt,
  fmt-check, build, run and clean implementations now live in
  `backend/script/`, and `backend/Makefile` is thin shims. The backend
  is its own project (own module, README, LICENSE, linter config,
  Dockerfile stage), and `Dockerfile.backend` only copies `backend/`
  into its builder, so its scripts have to live under `backend/`.
- The root `script/test`, `script/lint`, `script/fmt` and
  `script/fmt-check` now run the frontend step and then the matching
  `backend/script/*` step, so `script/check` — and therefore the
  pre-commit hook — gates both halves. The frontend-only steps moved
  into `script/frontend-*` so nothing is duplicated.
- `script/bootstrap` now provisions the backend's toolchain as well,
  because widening the gate without widening bootstrap left the
  documented fresh-clone path (`make setup`) installing a pre-commit
  hook that rejected every commit with `golangci-lint: not found`. Go
  is reused when the installed version is new enough, otherwise it is
  installed from the official `go1.25.7` release archive; golangci-lint
  is installed at exactly `2.7.2`, the version `Dockerfile.backend`
  pins, so local findings match CI. Both come from a specific release
  archive whose sha256 is hardcoded here and verified before anything
  is unpacked — never an install script piped to a shell — and both are
  symlinked onto `PATH`, since nvm-style activation does not reach
  `make` or the git hook.
- `script/frontend-check` is the frontend half of the gate, exposed as
  the `frontend-check` target, for the frontend Dockerfile: its build
  stage is a node image with no Go toolchain. The backend half is gated
  by `Dockerfile.backend`, and `script/cibuild` builds both images, so
  the two Dockerfiles together still gate the whole repo. The
  `backend-check` target is the mirror of it. Both targets are named
  after the script they shim, like every other target.
- `script/cibuild` builds both images through one `build_image` helper,
  and the Gitea workflow's only build step is `script/cibuild`; the raw
  `docker build -f Dockerfile.backend .` is gone from the workflow.
  `script/docker` likewise builds and tags both images.
- `backend/Makefile`'s `hooks` target is removed. It wrote the same
  `.git/hooks/pre-commit` as `script/install-precommit`, so the two
  clobbered each other and the developer silently ended up gating on
  only one half of the repo. `script/install-precommit` is now the only
  installer, and the hook it writes runs the repo-wide `script/check`.
- `backend/Makefile`'s `docker` target is removed too: the backend image
  builds from the repo root with a root-level Dockerfile, so it belongs
  to the root `script/docker` and `script/cibuild` rather than to a
  backend script that would have to reach outside `backend/`.
- `backend/script/lint` verifies that `.golangci.yml` still matches its
  pinned sha256 before running the linter. Offline hash comparison, no
  network. The pin is marked provisional in the file: it is the config
  currently on `main`, and the comment names PR #31 and the canonical
  hash that must replace it when #31 lands.
- Every script locates the repo root with the mandated
  `$(cd "$(dirname "$0")/.." && pwd -P)` idiom, `cd`s there, and calls
  siblings as `"$ROOT/script/<name>"`; the `SCRIPT_DIR` variant is gone.

READMEs at the root and in `backend/` document every script, the
backend's Getting Started separates commands run from `backend/` from
those run at the repo root, and `TODO.md` records the change.

README.md

@@ -28,23 +28,62 @@ docker run -p 8080:8080 netwatch
 This repository adheres to the
 [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
 standard: normalized scripts in `script/` are the entrypoints for the
-development workflow, and the Makefile targets are thin shims that call them. We
-provide:
+development workflow, and the Makefile targets are thin shims that call them.
 
-- `script/bootstrap` — install all dependencies (pinned node via nvm if needed,
-  yarn via corepack, `yarn install --frozen-lockfile`)
+The repo holds two projects: the frontend at the repo root and the Go backend in
+`backend/`, which has its own `script/` directory and its own shim Makefile. The
+root scripts cover both, so `make check` at the root fails if either half is
+broken. We provide:
+
+- `script/bootstrap` — install all dependencies, assuming nothing is present:
+  pinned node via nvm if needed, yarn via corepack,
+  `yarn install --frozen-lockfile`, and the backend's toolchain — Go (reused if
+  already new enough) and golangci-lint at the version `Dockerfile.backend`
+  pins. Everything not installed by the system package manager comes from a
+  hash-verified release archive and is symlinked onto `PATH`, so `make check`
+  works in a plain shell afterwards
 - `script/setup` — make a fresh clone ready for development: bootstrap plus the
   git pre-commit hook
-- `script/projectname` — print the project name (used for the Docker image tag)
-- `script/test` — run the production build as the test (no unit tests yet)
-- `script/lint` — run prettier in check mode
-- `script/fmt` — format all files (writes)
-- `script/fmt-check` — check formatting (read-only)
-- `script/check` — run test, lint, and fmt-check
-- `script/docker` — build the Docker image tagged via `script/projectname`
-- `script/cibuild` — CI entrypoint: plain `docker build .`
-- `script/precommit` — run by the git pre-commit hook; runs `script/check`
-- `script/install-precommit` — install the git pre-commit hook
+- `script/projectname` — print the project name (used for the Docker image tags)
+- `script/test` — run the whole repo's tests: `script/frontend-test`, then
+  `backend/script/test`
+- `script/lint` — lint the whole repo: `script/frontend-lint`, then
+  `backend/script/lint`
+- `script/fmt` — format the whole repo (writes): `script/frontend-fmt`, then
+  `backend/script/fmt`
+- `script/fmt-check` — check formatting across the whole repo (read-only)
+- `script/check` — run test, lint, and fmt-check; this is the repo-wide gate
+- `script/frontend-test` — the frontend's test: the production build (no unit
+  tests yet)
+- `script/frontend-lint` — run prettier in check mode
+- `script/frontend-fmt` — format everything prettier understands (writes)
+- `script/frontend-fmt-check` — check prettier formatting (read-only)
+- `script/frontend-check` — the frontend half of `script/check`, shimmed by
+  `make frontend-check` and used by `Dockerfile`, whose build stage is a node
+  image with no Go toolchain. Its mirror `make backend-check` shims to
+  `backend/script/check`
+- `script/docker` — build both images, tagged via `script/projectname`:
+  `netwatch` from `Dockerfile` and `netwatch-server` from `Dockerfile.backend`
+- `script/cibuild` — CI entrypoint: builds both images; the only build step in
+  the Gitea workflow
+- `script/precommit` — run by the git pre-commit hook; runs `script/check`, so a
+  commit is gated on both halves of the repo
+- `script/install-precommit` — install the git pre-commit hook; this is the
+  repo's only pre-commit hook installer
+
+The backend's scripts are shimmed by `backend/Makefile` and are also called by
+the root scripts above:
+
+- `backend/script/build` — compile `netwatch-server` with version and
+  architecture stamped in
+- `backend/script/test` — run the Go tests under a 30-second timeout
+- `backend/script/lint` — assert `.golangci.yml` still matches its pinned
+  sha256, then run golangci-lint
+- `backend/script/fmt` — format the Go sources (writes)
+- `backend/script/fmt-check` — check Go formatting (read-only)
+- `backend/script/check` — run the backend's test, lint, and fmt-check
+- `backend/script/run` — build and run the server locally
+- `backend/script/clean` — remove build artifacts
 
 ## Rationale