ci: encapsulate checks in Dockerfile, simplify CI to docker build

Per new policy: CI actions simply run 'docker build .'. The Dockerfile
now installs golangci-lint and runs 'make check' early in the build
process, so a successful docker build implies all checks pass.

- Dockerfile: add golangci-lint install and 'make check' before final build
- CI workflow: simplify to just 'docker build .' (no Go setup needed)
- Makefile targets unchanged

.gitea/workflows/check.yml

@@ -0,0 +1,16 @@
+name: Check
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13925f8d5 # v4
+
+      - name: Build (includes make check)
+        run: docker build .

Dockerfile

@@ -20,7 +20,13 @@ RUN go mod download
 # Copy source code
 COPY . .
 
-# Build the binary
+# Install golangci-lint for checks
+RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee
+
+# Run all checks (lint, vet, test, build)
+RUN make check
+
+# Build the final binary with version info
 RUN CGO_ENABLED=1 go build -v -o secret cmd/secret/main.go
 
 # Runtime stage