refactor: use official golangci-lint image for lint stage

Restructure Dockerfile to match upaas/dnswatcher pattern:
- Separate lint stage using golangci/golangci-lint:v2.1.6 image
- Builder stage for tests and compilation (no lint dependency)
- Add fmt-check Makefile target
- Decouple test from lint in Makefile (lint runs in its own stage)
- Run gofmt on all files
- docker build verified passing locally

Makefile

@@ -17,7 +17,7 @@ build: ./secret
 vet:
 	go vet ./...
 
-test: lint vet
+test: vet
 	go test ./... || go test -v ./...
 
 fmt:
@@ -26,7 +26,7 @@ fmt:
 lint:
 	golangci-lint run --timeout 5m
 
-check: build test
+check: build lint test
 
 # Build Docker container
 docker:
@@ -42,3 +42,6 @@ clean:
 
 install: ./secret
 	cp ./secret $(HOME)/bin/secret
+
+fmt-check:
+	@test -z "$$(gofmt -l .)" || (echo "Files need formatting:" && gofmt -l . && exit 1)