chore: consolidate DBURL into DATA_DIR, codebase audit for 1.0.0

DBURL → DATA_DIR consolidation:
- Remove DBURL env var entirely; main DB now lives at {DATA_DIR}/webhooker.db
- database.go constructs DB path from config.DataDir, ensures dir exists
- Update DATA_DIR prod default from /data/events to /data
- Update all tests to use DataDir instead of DBURL
- Update Dockerfile: /data (not /data/events) for all SQLite databases
- Update README configuration table, Docker examples, architecture docs

Dead code removal:
- Remove unused IndexResponse struct (handlers/index.go)
- Remove unused TemplateData struct (handlers/handlers.go)

Stale comment cleanup:
- Remove TODO in server.go (DB cleanup handled by fx lifecycle)
- Fix nolint:golint → nolint:revive on ServerParams for consistency
- Clean up verbose middleware/routing comments in routes.go
- Fix TODO fan-out description (worker pool, not goroutine-per-target)

.gitignore fixes:
- Add data/ directory to gitignore
- Remove stale config.yaml entry (env-only config since rework)

README.md

@@ -61,8 +61,7 @@ or `prod` (default: `dev`).
 | ----------------------- | ----------------------------------- | -------- |
 | `WEBHOOKER_ENVIRONMENT` | `dev` or `prod`                     | `dev`    |
 | `PORT`                  | HTTP listen port                    | `8080`   |
-| `DBURL`                 | SQLite connection string (main app DB) | *(required)* |
-| `DATA_DIR`              | Directory for per-webhook event DBs | `./data` (dev) / `/data/events` (prod) |
+| `DATA_DIR`              | Directory for all SQLite databases  | `./data` (dev) / `/data` (prod) |
 | `DEBUG`                 | Enable debug logging                | `false`  |
 | `METRICS_USERNAME`      | Basic auth username for `/metrics`  | `""`     |
 | `METRICS_PASSWORD`      | Basic auth password for `/metrics`  | `""`     |
@@ -82,18 +81,16 @@ is only displayed once.
 docker run -d \
   -p 8080:8080 \
   -v /path/to/data:/data \
-  -e DBURL="file:/data/webhooker.db?cache=shared&mode=rwc" \
-  -e DATA_DIR="/data/events" \
   -e WEBHOOKER_ENVIRONMENT=prod \
   webhooker:latest
 ```
 
 The container runs as a non-root user (`webhooker`, UID 1000), exposes
 port 8080, and includes a health check against
-`/.well-known/healthcheck`. The `/data` volume holds both the main
-application database and the per-webhook event databases (in
-`/data/events/`). Mount this as a persistent volume to preserve data
-across container restarts.
+`/.well-known/healthcheck`. The `/data` volume holds all SQLite
+databases: the main application database (`webhooker.db`) and the
+per-webhook event databases (`events-{uuid}.db`). Mount this as a
+persistent volume to preserve data across container restarts.
 
 ## Rationale
 
@@ -412,10 +409,10 @@ All entities include these fields from `BaseModel`:
 
 webhooker uses **separate SQLite database files**: a main application
 database for configuration data and per-webhook databases for event
-storage.
+storage. All database files live in the `DATA_DIR` directory.
 
-**Main Application Database** (`DBURL`) — stores configuration and
-application state:
+**Main Application Database** (`{DATA_DIR}/webhooker.db`) — stores
+configuration and application state:
 
 - **Settings** — auto-managed key-value config (e.g. session encryption
   key)
@@ -428,8 +425,8 @@ application state:
 On first startup the main database is auto-migrated, a session
 encryption key is generated and stored, and an `admin` user is created.
 
-**Per-Webhook Event Databases** (`DATA_DIR`) — each webhook gets its own
-dedicated SQLite file named `events-{webhook_uuid}.db`, containing:
+**Per-Webhook Event Databases** (`{DATA_DIR}/events-{webhook_uuid}.db`)
+— each webhook gets its own dedicated SQLite file containing:
 
 - **Events** — captured incoming webhook payloads
 - **Deliveries** — event-to-target pairings and their status
@@ -810,8 +807,8 @@ The Dockerfile uses a multi-stage build:
    golangci-lint, downloads dependencies, copies source, runs `make
    check` (format verification, linting, tests, compilation).
 2. **Runtime stage** (`alpine:3.21`) — copies the binary, creates the
-   `/data/events` directory for per-webhook event databases, runs as
-   non-root user, exposes port 8080, includes a health check.
+   `/data` directory for all SQLite databases, runs as non-root user,
+   exposes port 8080, includes a health check.
 
 The builder uses Debian rather than Alpine because GORM's SQLite
 dialect pulls in CGO-dependent headers at compile time. The runtime
@@ -862,8 +859,8 @@ linted, tested, and compiled.
       Large bodies (≥16KB) are fetched from the per-webhook DB on demand.
 - [x] Database target type marks delivery as immediately successful
       (events are already in the per-webhook DB)
-- [x] Parallel fan-out: all targets for an event are delivered
-      simultaneously in separate goroutines
+- [x] Parallel fan-out: all targets for an event are delivered via
+      the bounded worker pool (no goroutine-per-target)
 - [x] Circuit breaker for retry targets: tracks consecutive failures
       per target, opens after 5 failures (30s cooldown), half-open
       probe to test recovery