bring repo into policy compliance; vendor assets; Gitea CI

Vendor the front-end assets and drop the third-party CDN dependencies
(BootstrapCDN is being sunset): the bootstrap 4.0.0 css/js, jquery
3.2.1 slim, and popper 1.12.9 now live under static/ and are served
from the app, byte-for-byte identical to the previous SRI-pinned files.

Migrate CI from Drone to a Gitea Actions workflow that runs
docker build . on push, with the checkout action pinned by SHA.

Bring the repo up to standard:

- add REPO_POLICIES.md, .editorconfig, .dockerignore, .golangci.yml,
  and a comprehensive root-anchored .gitignore
- rewrite the Makefile with the required test/lint/fmt/fmt-check/check/
  docker/hooks targets (golangci-lint, 30s test timeout, verbose rerun
  on failure, check modifies nothing)
- rewrite the Dockerfile as a hash-pinned multistage build: a lint
  stage (golangci-lint), a glibc build+test stage (the legacy sqlite
  driver needs cgo+glibc), and a debian-slim runtime carrying the
  binary, templates, and static assets
- add real tests for the hn package
- bring the code into golangci-lint (default: all) compliance: fix the
  malformed gorm struct tags, check previously-ignored errors, dispatch
  the zerolog error event, avoid a uint->Duration overflow, split long
  functions, and add doc comments — all behaviour-preserving
- expand the README with the required sections

Dockerfile

@@ -1,32 +1,55 @@
-FROM golang:1.14 as builder
+# syntax=docker/dockerfile:1
 
-WORKDIR /go/src/git.eeqj.de/sneak/orangesite
+# Lint stage — fast feedback on formatting and lint issues.
+# golangci/golangci-lint:v2.12.1 (Debian; bundles go, make, gcc), 2026-07-26
+FROM golangci/golangci-lint@sha256:c9843d374ca80ecbac86081ec4dd7fe2bb6187b03224f59a0cc2f80759e1845b AS lint
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN make fmt-check
+RUN make lint
+
+# Build stage — compiles and tests. CGO is required by mattn/go-sqlite3, and
+# the pinned (legacy) sqlite driver only builds against glibc, so this stage
+# is Debian-based rather than alpine.
+# golang:1.24-bookworm, 2026-07-26
+FROM golang@sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac AS builder
+WORKDIR /src
+
+# Force BuildKit to complete the lint stage before compiling/testing.
+COPY --from=lint /src/go.sum /dev/null
+
+COPY go.mod go.sum ./
+RUN go mod download
 COPY . .
 
-#RUN make lint && make build
-RUN make build
+RUN make test
 
-WORKDIR /go
-RUN tar cvfz go-src.tgz src && du -sh *
+ARG VERSION=dev
+ARG TARGETARCH=unknown
+RUN CGO_ENABLED=1 go build -trimpath \
+    -ldflags="-s -w -X main.Version=${VERSION} -X main.Buildarch=${TARGETARCH}" \
+    -o /server ./cmd/server
 
-# this container doesn't do anything except hold the build artifact
-# and make sure it compiles.
+# Runtime stage — the (glibc-linked) binary plus the on-disk templates and
+# vendored assets. ca-certificates is needed for the outbound TLS calls to
+# the Hacker News API.
+# debian:bookworm-slim, 2026-07-26
+FROM debian@sha256:7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818
 
-FROM alpine
-
-RUN mkdir -p /app/bin
-
-COPY --from=builder /go/src/git.eeqj.de/sneak/orangesite/server /app/bin/server
-# FIXME figure out how to embed these stupid templates
-COPY --from=builder /go/src/git.eeqj.de/sneak/orangesite/view /app/view
-
-# put the source in there too for safekeeping
-COPY --from=builder /go/go-src.tgz /usr/local/src/go-src.tgz
-
-# this is where the db gets stored:
-VOLUME /data
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
-CMD /app/bin/server
+COPY --from=builder /server /usr/local/bin/server
+COPY view ./view
+COPY static ./static
 
-# FIXME add testing
+# sqlite database lives on a mounted volume
+VOLUME /data
+ENV DATABASE_PATH=/data/storage.sqlite
+
+EXPOSE 8080
+ENTRYPOINT ["server"]