rework: multi-stage Dockerfile lint/build/runtime pattern

Rewrites CI to use a multi-stage Dockerfile per REPO_POLICIES:

- Lint stage: golangci/golangci-lint:v2.1.6-alpine runs make fmt-check
  and make lint
- Build stage: golang:1.24.4-alpine runs make test, then builds binary
  with CGO enabled (required for mattn/go-sqlite3)
- Runtime stage: alpine:3.21 copies binary, runs as non-root user

All base images pinned by @sha256 hash.

CI workflow simplified to just 'docker build .' since the Dockerfile
already runs make check (fmt-check + lint + test).

Makefile aligned with REPO_POLICIES:
- check target uses prereqs (fmt-check lint test)
- fmt-check is read-only (gofmt -l, not go fmt)
- Added docker and hooks targets
- test uses -race -timeout 30s

Added .dockerignore for efficient build context.

Makefile

@@ -1,4 +1,4 @@
-.PHONY: test fmt lint build clean all
+.PHONY: test fmt lint fmt-check check build clean all docker hooks
 
 # Version number
 VERSION := 0.0.1
@@ -14,21 +14,12 @@ LDFLAGS := -X 'git.eeqj.de/sneak/vaultik/internal/globals.Version=$(VERSION)' \
 all: vaultik
 
 # Run tests
-test: lint fmt-check
-	@echo "Running tests..."
-	@if ! go test -v -timeout 10s ./... 2>&1; then \
-		echo ""; \
-		echo "TEST FAILURES DETECTED"; \
-		echo "Run 'go test -v ./internal/database' to see database test details"; \
-		exit 1; \
-	fi
+test:
+	go test -race -timeout 30s ./...
 
-# Check if code is formatted
+# Check if code is formatted (read-only)
 fmt-check:
-	@if [ -n "$$(go fmt ./...)" ]; then \
-		echo "Error: Code is not formatted. Run 'make fmt' to fix."; \
-		exit 1; \
-	fi
+	@test -z "$$(gofmt -l .)" || (echo "Files not formatted:" && gofmt -l . && exit 1)
 
 # Format code
 fmt:
@@ -36,7 +27,7 @@ fmt:
 
 # Run linter
 lint:
-	golangci-lint run
+	golangci-lint run ./...
 
 # Build binary
 vaultik: internal/*/*.go cmd/vaultik/*.go
@@ -47,11 +38,6 @@ clean:
 	rm -f vaultik
 	go clean
 
-# Install dependencies
-deps:
-	go mod download
-	go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
-
 # Run tests with coverage
 test-coverage:
 	go test -v -coverprofile=coverage.out ./...
@@ -69,10 +55,15 @@ install: vaultik
 	cp ./vaultik $(HOME)/bin/
 
 # Run all checks (formatting, linting, tests) without modifying files
-check:
-	@echo "==> Checking formatting..."
-	@test -z "$$(gofmt -l .)" || (echo "Files not formatted:" && gofmt -l . && exit 1)
-	@echo "==> Running linter..."
-	golangci-lint run ./...
-	@echo "==> Running tests..."
-	go test -race -timeout 30s ./...
+check: fmt-check lint test
+
+# Build Docker image
+docker:
+	docker build -t vaultik .
+
+# Install pre-commit hook
+hooks:
+	@printf '#!/bin/sh\nset -e\n' > .git/hooks/pre-commit
+	@printf 'go mod tidy\ngo fmt ./...\ngit diff --exit-code -- go.mod go.sum || { echo "go mod tidy changed files; please stage and retry"; exit 1; }\n' >> .git/hooks/pre-commit
+	@printf 'make check\n' >> .git/hooks/pre-commit
+	@chmod +x .git/hooks/pre-commit