bring repo into policy compliance; vendor assets; Gitea CI

Vendor the front-end assets and drop the third-party CDN dependencies
(BootstrapCDN is being sunset): the bootstrap 4.0.0 css/js, jquery
3.2.1 slim, and popper 1.12.9 now live under static/ and are served
from the app, byte-for-byte identical to the previous SRI-pinned files.

Migrate CI from Drone to a Gitea Actions workflow that runs
docker build . on push, with the checkout action pinned by SHA.

Bring the repo up to standard:

- add REPO_POLICIES.md, .editorconfig, .dockerignore, .golangci.yml,
  and a comprehensive root-anchored .gitignore
- rewrite the Makefile with the required test/lint/fmt/fmt-check/check/
  docker/hooks targets (golangci-lint, 30s test timeout, verbose rerun
  on failure, check modifies nothing)
- rewrite the Dockerfile as a hash-pinned multistage build: a lint
  stage (golangci-lint), a glibc build+test stage (the legacy sqlite
  driver needs cgo+glibc), and a debian-slim runtime carrying the
  binary, templates, and static assets
- add real tests for the hn package
- bring the code into golangci-lint (default: all) compliance: fix the
  malformed gorm struct tags, check previously-ignored errors, dispatch
  the zerolog error event, avoid a uint->Duration overflow, split long
  functions, and add doc comments — all behaviour-preserving
- expand the README with the required sections

Makefile

@@ -2,81 +2,77 @@
 export DATABASE_PATH := ./storage.sqlite
 
 VERSION := $(shell git rev-parse --short HEAD)
-BUILDTIME := $(shell date -u '+%Y-%m-%dT%H:%M:%SZ')
-BUILDTIMEFILENAME := $(shell date -u '+%Y%m%d-%H%M%SZ')
-BUILDTIMETAG := $(shell date -u '+%Y%m%d%H%M%S')
-BUILDUSER := $(shell whoami)
-BUILDHOST := $(shell hostname -s)
 BUILDARCH := $(shell uname -m)
+BUILDTIMETAG := $(shell date -u '+%Y%m%d%H%M%S')
 
 FN := server
 IMAGENAME := sneak/orangesite
 
-UNAME_S := $(shell uname -s)
-
 GOLDFLAGS += -X main.Version=$(VERSION)
 GOLDFLAGS += -X main.Buildarch=$(BUILDARCH)
+GOFLAGS := -ldflags "$(GOLDFLAGS)"
 
-# osx can't statically link apparently?!
-ifeq ($(UNAME_S),Darwin)
-	GOFLAGS := -ldflags "$(GOLDFLAGS)"
-endif
-
-ifneq ($(UNAME_S),Darwin)
-	GOFLAGS = -ldflags "-linkmode external -extldflags -static $(GOLDFLAGS)"
-endif
+.PHONY: default run debug build clean \
+	test lint fmt fmt-check check docker hooks \
+	docker-dist docker-push
 
 default: run
 
-debug: build
-	GOTRACEBACK=all DEBUG=1 ./$(FN)
+# --- development ---------------------------------------------------------
 
 run: build
 	./$(FN)
 
+debug: build
+	GOTRACEBACK=all DEBUG=1 ./$(FN)
+
+build:
+	go build -o $(FN) $(GOFLAGS) ./cmd/$(FN)
+
 clean:
-	-rm ./$(FN)
+	-rm -f ./$(FN)
 
-build: ./$(FN)
+# --- required policy targets ---------------------------------------------
 
-.lintsetup:
-	go get -v -u golang.org/x/lint/golint
-	go get -u github.com/GeertJohan/fgt
-	touch .lintsetup
+# run tests quietly; on failure, rerun verbosely for diagnostics
+test:
+	@go test -timeout 30s ./... || \
+		{ echo "--- Rerunning with -v for details ---"; \
+		  go test -timeout 30s -v ./...; exit 1; }
 
-lint: fmt .lintsetup
-	fgt golint ./...
-
-go-get:
-	cd cmd/$(FN) && go get -v
-
-./$(FN): */*.go cmd/*/*.go go-get
-	cd cmd/$(FN) && go build -o ../../$(FN) $(GOFLAGS) .
+lint:
+	golangci-lint run ./...
 
 fmt:
 	gofmt -s -w .
 
-test: lint build-docker-image
+fmt-check:
+	@out="$$(gofmt -s -l .)"; \
+	if [ -n "$$out" ]; then \
+		echo "gofmt needed on:"; echo "$$out"; exit 1; \
+	fi
 
-is_uncommitted:
-	git diff --exit-code >/dev/null 2>&1
+# check must not modify any files in the repo
+check: fmt-check lint test
 
-build-docker-image: clean
+docker:
 	docker build -t $(IMAGENAME) .
 
-build-docker-image-dist: is_uncommitted clean
-	docker build -t $(IMAGENAME):$(VERSION) -t $(IMAGENAME):latest -t $(IMAGENAME):$(BUILDTIMETAG) .
+hooks:
+	@printf '#!/bin/sh\nset -e\n' > .git/hooks/pre-commit
+	@printf 'go mod tidy\ngofmt -s -w .\n' >> .git/hooks/pre-commit
+	@printf 'git diff --exit-code -- go.mod go.sum || { echo "go mod tidy changed files; please stage and retry"; exit 1; }\n' >> .git/hooks/pre-commit
+	@printf 'make check\n' >> .git/hooks/pre-commit
+	@chmod +x .git/hooks/pre-commit
+	@echo "installed .git/hooks/pre-commit"
 
-dist: lint build-docker-image
-	-mkdir -p ./output
-	docker run --rm --entrypoint cat $(IMAGENAME) /bin/$(FN) > output/$(FN)
-	docker save $(IMAGENAME) | bzip2 > output/$(BUILDTIMEFILENAME).$(FN).tbz2
+# --- image distribution --------------------------------------------------
 
-hub: upload-docker-image
+docker-dist: docker
+	docker tag $(IMAGENAME) $(IMAGENAME):$(VERSION)
+	docker tag $(IMAGENAME) $(IMAGENAME):$(BUILDTIMETAG)
 
-upload-docker-image: build-docker-image
+docker-push: docker-dist
 	docker push $(IMAGENAME):$(VERSION)
 	docker push $(IMAGENAME):$(BUILDTIMETAG)
 	docker push $(IMAGENAME):latest
-
-.PHONY: build fmt test is_uncommitted build-docker-image dist hub upload-docker-image clean run rundebug default build-docker-image-dist