feat: bring repo up to REPO_POLICIES standards (#6)

## Summary

This PR brings the webhooker repo into full REPO_POLICIES compliance, addressing both [issue #1](#1) and [issue #2](#2).

## Changes

### New files
- **`cmd/webhooker/main.go`** — The missing application entry point. Uses Uber fx to wire together all internal packages (config, database, logger, server, handlers, middleware, healthcheck, globals, session). Minimal glue code.
- **`REPO_POLICIES.md`** — Fetched from authoritative source (`sneak/prompts`)
- **`.editorconfig`** — Fetched from authoritative source
- **`.dockerignore`** — Sensible Go project exclusions
- **`.gitea/workflows/check.yml`** — CI workflow that runs `docker build .` on push to any branch (Gitea Actions format, actions/checkout pinned by sha256)
- **`configs/config.yaml.example`** — Moved from root `config.yaml`

### Modified files
- **`Makefile`** — Complete rewrite with all REPO_POLICIES required targets: `test`, `lint`, `fmt`, `fmt-check`, `check`, `build`, `hooks`, `docker`, `clean`, plus `dev`, `run`, `deps`
- **`Dockerfile`** — Complete rewrite:
  - Builder: `golang:1.24` (Debian-based, pinned by `sha256:d2d2bc1c84f7...`). Debian needed because `gorm.io/driver/sqlite` pulls `mattn/go-sqlite3` (CGO) which fails on Alpine musl.
  - golangci-lint v1.64.8 installed from GitHub release archive with sha256 verification (v1.x because `.golangci.yml` uses v1 config format)
  - Runs `make check` (fmt-check + lint + test + build) as build step
  - Final stage: `alpine:3.21` (pinned by `sha256:c3f8e73fdb79...`) with non-root user, healthcheck, port 8080
- **`README.md`** — Rewritten with all required REPO_POLICIES sections: description line with name/purpose/category/license/author, Getting Started, Rationale, Design, TODO (integrated from TODO.md), License, Author
- **`.gitignore`** — Fixed `webhooker` pattern to `/webhooker` (was blocking `cmd/webhooker/`), added `config.yaml` to prevent committing runtime config with secrets
- **`static/static.go`** — Removed `vendor` from embed directive (directory was empty/missing)
- **`internal/database/database_test.go`** — Fixed to use in-memory config via `afero.MemMapFs` instead of depending on `config.yaml` on disk. Test is now properly isolated.
- **`go.mod`/`go.sum`** — `go mod tidy`

### Removed files
- **`TODO.md`** — Content integrated into README.md TODO section
- **`config.yaml`** — Moved to `configs/config.yaml.example`

## Verification
- `docker build .` passes (lint ✅, test ✅, build ✅)
- All existing tests pass with no modifications to assertions or test logic
- `.golangci.yml` untouched

closes #1
closes #2

Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de>
Reviewed-on: #6
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

Makefile

@@ -1,39 +1,43 @@
-.PHONY: test fmt lint build run clean
+.PHONY: test lint fmt fmt-check check build run dev deps docker clean hooks
 
 # Default target
-test: lint
-	go test -v ./...
+.DEFAULT_GOAL := check
 
-fmt:
-	go fmt ./...
+test:
+	go test -v -race -timeout 30s ./...
 
 lint:
-	golangci-lint run
+	golangci-lint run --config .golangci.yml ./...
 
-build: test
-	go build -o bin/webhooker cmd/webhooker/main.go
+fmt:
+	gofmt -s -w .
+	@command -v goimports >/dev/null 2>&1 && goimports -w . || true
+
+fmt-check:
+	@test -z "$$(gofmt -s -l .)" || { echo "gofmt needed on:"; gofmt -s -l .; exit 1; }
+
+check: fmt-check lint test build
+
+build:
+	go build -o bin/webhooker ./cmd/webhooker
 
 run: build
 	./bin/webhooker
 
-clean:
-	rm -rf bin/
-
-# Development helpers
-.PHONY: dev deps
-
 dev:
-	go run cmd/webhooker/main.go
+	go run ./cmd/webhooker
 
 deps:
 	go mod download
 	go mod tidy
 
-# Docker targets
-.PHONY: docker-build docker-run
-
-docker-build:
+docker:
 	docker build -t webhooker:latest .
 
-docker-run: docker-build
-	docker run --rm -p 8080:8080 webhooker:latest 
+clean:
+	rm -rf bin/
+
+hooks:
+	@printf '#!/bin/sh\nmake check\n' > .git/hooks/pre-commit
+	@chmod +x .git/hooks/pre-commit
+	@echo "pre-commit hook installed"