chore: consolidate DBURL into DATA_DIR, codebase audit for 1.0.0

DBURL → DATA_DIR consolidation:
- Remove DBURL env var entirely; main DB now lives at {DATA_DIR}/webhooker.db
- database.go constructs DB path from config.DataDir, ensures dir exists
- Update DATA_DIR prod default from /data/events to /data
- Update all tests to use DataDir instead of DBURL
- Update Dockerfile: /data (not /data/events) for all SQLite databases
- Update README configuration table, Docker examples, architecture docs

Dead code removal:
- Remove unused IndexResponse struct (handlers/index.go)
- Remove unused TemplateData struct (handlers/handlers.go)

Stale comment cleanup:
- Remove TODO in server.go (DB cleanup handled by fx lifecycle)
- Fix nolint:golint → nolint:revive on ServerParams for consistency
- Clean up verbose middleware/routing comments in routes.go
- Fix TODO fan-out description (worker pool, not goroutine-per-target)

.gitignore fixes:
- Add data/ directory to gitignore
- Remove stale config.yaml entry (env-only config since rework)

internal/server/routes.go

@@ -14,46 +14,29 @@ import (
 func (s *Server) SetupRoutes() {
 	s.router = chi.NewRouter()
 
-	// the mux .Use() takes a http.Handler wrapper func, like most
-	// things that deal with "middlewares" like alice et c, and will
-	// call ServeHTTP on it.  These middlewares applied by the mux (you
-	// can .Use() more than one) will be applied to every request into
-	// the service.
-
+	// Global middleware stack — applied to every request.
 	s.router.Use(middleware.Recoverer)
 	s.router.Use(middleware.RequestID)
 	s.router.Use(s.mw.Logging())
 
-	// add metrics middleware only if we can serve them behind auth
+	// Metrics middleware (only if credentials are configured)
 	if s.params.Config.MetricsUsername != "" {
 		s.router.Use(s.mw.Metrics())
 	}
 
-	// set up CORS headers
 	s.router.Use(s.mw.CORS())
-
-	// timeout for request context; your handlers must finish within
-	// this window:
 	s.router.Use(middleware.Timeout(60 * time.Second))
 
-	// this adds a sentry reporting middleware if and only if sentry is
-	// enabled via setting of SENTRY_DSN in env.
+	// Sentry error reporting (if SENTRY_DSN is set). Repanic is true
+	// so panics still bubble up to the Recoverer middleware above.
 	if s.sentryEnabled {
-		// Options docs at
-		// https://docs.sentry.io/platforms/go/guides/http/
-		// we set sentry to repanic so that all panics bubble up to the
-		// Recoverer chi middleware above.
 		sentryHandler := sentryhttp.New(sentryhttp.Options{
 			Repanic: true,
 		})
 		s.router.Use(sentryHandler.Handle)
 	}
 
-	////////////////////////////////////////////////////////////////////////
-	// ROUTES
-	// complete docs: https://github.com/go-chi/chi
-	////////////////////////////////////////////////////////////////////////
-
+	// Routes
 	s.router.Get("/", s.h.HandleIndex())
 
 	s.router.Mount("/s", http.StripPrefix("/s", http.FileServer(http.FS(static.Static))))