feat: bring repo up to REPO_POLICIES standards

- Create cmd/webhooker/main.go with fx dependency injection wiring
- Add REPO_POLICIES.md, .editorconfig, .dockerignore
- Add .gitea/workflows/check.yml for CI (docker build on push)
- Rewrite Makefile with all required targets (test, lint, fmt, fmt-check,
  check, build, hooks, docker, clean, dev, run, deps)
- Rewrite Dockerfile with sha256-pinned base images, golangci-lint
  installed from verified release archive, make check as build step
- Fix README.md: add required sections (description, getting started,
  rationale, design, TODO, license, author)
- Integrate TODO.md content into README.md and remove TODO.md
- Move config.yaml to configs/config.yaml.example
- Fix .gitignore pattern for webhooker binary
- Fix static/static.go embed directive (remove empty vendor dir)
- Fix database test to use in-memory config (no filesystem dependency)

closes #1
closes #2

cmd/webhooker/main.go

@@ -0,0 +1,43 @@
+package main
+
+import (
+	"runtime"
+
+	"git.eeqj.de/sneak/webhooker/internal/config"
+	"git.eeqj.de/sneak/webhooker/internal/database"
+	"git.eeqj.de/sneak/webhooker/internal/globals"
+	"git.eeqj.de/sneak/webhooker/internal/handlers"
+	"git.eeqj.de/sneak/webhooker/internal/healthcheck"
+	"git.eeqj.de/sneak/webhooker/internal/logger"
+	"git.eeqj.de/sneak/webhooker/internal/middleware"
+	"git.eeqj.de/sneak/webhooker/internal/server"
+	"git.eeqj.de/sneak/webhooker/internal/session"
+	"go.uber.org/fx"
+)
+
+// Build-time variables set via -ldflags.
+var (
+	version = "dev"
+	appname = "webhooker"
+)
+
+func main() {
+	globals.Appname = appname
+	globals.Version = version
+	globals.Buildarch = runtime.GOARCH
+
+	fx.New(
+		fx.Provide(
+			globals.New,
+			logger.New,
+			config.New,
+			database.New,
+			healthcheck.New,
+			session.New,
+			handlers.New,
+			middleware.New,
+			server.New,
+		),
+		fx.Invoke(func(*server.Server) {}),
+	).Run()
+}