feat: bring repo up to REPO_POLICIES standards (#6)

## Summary

This PR brings the webhooker repo into full REPO_POLICIES compliance, addressing both [issue #1](#1) and [issue #2](#2).

## Changes

### New files
- **`cmd/webhooker/main.go`** — The missing application entry point. Uses Uber fx to wire together all internal packages (config, database, logger, server, handlers, middleware, healthcheck, globals, session). Minimal glue code.
- **`REPO_POLICIES.md`** — Fetched from authoritative source (`sneak/prompts`)
- **`.editorconfig`** — Fetched from authoritative source
- **`.dockerignore`** — Sensible Go project exclusions
- **`.gitea/workflows/check.yml`** — CI workflow that runs `docker build .` on push to any branch (Gitea Actions format, actions/checkout pinned by sha256)
- **`configs/config.yaml.example`** — Moved from root `config.yaml`

### Modified files
- **`Makefile`** — Complete rewrite with all REPO_POLICIES required targets: `test`, `lint`, `fmt`, `fmt-check`, `check`, `build`, `hooks`, `docker`, `clean`, plus `dev`, `run`, `deps`
- **`Dockerfile`** — Complete rewrite:
  - Builder: `golang:1.24` (Debian-based, pinned by `sha256:d2d2bc1c84f7...`). Debian needed because `gorm.io/driver/sqlite` pulls `mattn/go-sqlite3` (CGO) which fails on Alpine musl.
  - golangci-lint v1.64.8 installed from GitHub release archive with sha256 verification (v1.x because `.golangci.yml` uses v1 config format)
  - Runs `make check` (fmt-check + lint + test + build) as build step
  - Final stage: `alpine:3.21` (pinned by `sha256:c3f8e73fdb79...`) with non-root user, healthcheck, port 8080
- **`README.md`** — Rewritten with all required REPO_POLICIES sections: description line with name/purpose/category/license/author, Getting Started, Rationale, Design, TODO (integrated from TODO.md), License, Author
- **`.gitignore`** — Fixed `webhooker` pattern to `/webhooker` (was blocking `cmd/webhooker/`), added `config.yaml` to prevent committing runtime config with secrets
- **`static/static.go`** — Removed `vendor` from embed directive (directory was empty/missing)
- **`internal/database/database_test.go`** — Fixed to use in-memory config via `afero.MemMapFs` instead of depending on `config.yaml` on disk. Test is now properly isolated.
- **`go.mod`/`go.sum`** — `go mod tidy`

### Removed files
- **`TODO.md`** — Content integrated into README.md TODO section
- **`config.yaml`** — Moved to `configs/config.yaml.example`

## Verification
- `docker build .` passes (lint ✅, test ✅, build ✅)
- All existing tests pass with no modifications to assertions or test logic
- `.golangci.yml` untouched

closes #1
closes #2

Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de>
Reviewed-on: #6
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

TODO.md

@@ -1,102 +0,0 @@
-# Webhooker TODO List
-
-## Phase 1: Security & Infrastructure Hardening
-- [ ] Implement proper security headers (HSTS, CSP, X-Frame-Options, etc.)
-- [ ] Add request timeouts and context handling
-- [ ] Set maximum request/response body sizes
-- [ ] Implement rate limiting middleware
-- [ ] Add CSRF protection for forms
-- [ ] Set up proper CORS handling
-- [ ] Implement request ID tracking through entire request lifecycle
-- [ ] Add panic recovery with proper error reporting
-
-## Phase 2: Authentication & Authorization
-- [ ] Create authentication middleware that checks session
-- [ ] Implement proper session expiration
-- [ ] Add "Remember me" functionality
-- [ ] Implement password reset flow
-- [ ] Add user registration (if needed)
-- [ ] Create authorization middleware for protected routes
-- [ ] Add API key authentication for programmatic access
-
-## Phase 3: Database Models & Migrations
-- [ ] Create webhook source model (id, user_id, name, target_url, secret, created_at, etc.)
-- [ ] Create webhook request log model (id, source_id, request_headers, request_body, response_status, etc.)
-- [ ] Create webhook retry model for failed deliveries
-- [ ] Add database indexes for performance
-- [ ] Create migration system for schema updates
-
-## Phase 4: Webhook Source Management UI
-- [ ] Implement webhook source list page (/sources)
-- [ ] Create webhook source creation form (/sources/new)
-- [ ] Build webhook source detail page (/source/{id})
-- [ ] Add webhook source edit functionality (/source/{id}/edit)
-- [ ] Implement webhook source deletion with confirmation
-- [ ] Add webhook URL generation and display
-- [ ] Create secret key generation and management
-- [ ] Add webhook testing functionality
-
-## Phase 5: Webhook Processing Engine
-- [ ] Implement actual webhook reception at /webhook/{uuid}
-- [ ] Validate incoming webhook requests (headers, body size, etc.)
-- [ ] Create webhook forwarding logic to target URLs
-- [ ] Implement request/response logging
-- [ ] Add webhook signature verification (GitHub, Stripe, etc. formats)
-- [ ] Create webhook transformation capabilities (headers, body)
-- [ ] Implement timeout handling for outbound requests
-- [ ] Add retry logic with exponential backoff
-
-## Phase 6: Webhook Logs & Analytics
-- [ ] Create webhook request log viewer (/source/{id}/logs)
-- [ ] Add filtering and search capabilities for logs
-- [ ] Implement request/response body viewer
-- [ ] Create analytics dashboard (success rates, response times)
-- [ ] Add webhook health monitoring
-- [ ] Implement alerting for failed webhooks
-- [ ] Create log retention policies
-
-## Phase 7: Advanced Features
-- [ ] Add webhook request replay functionality
-- [ ] Implement webhook request batching
-- [ ] Create webhook request queuing system
-- [ ] Add support for multiple target URLs per source
-- [ ] Implement conditional forwarding based on payload
-- [ ] Add webhook transformation templates
-- [ ] Create webhook debugging tools
-- [ ] Implement webhook scheduling/delayed delivery
-
-## Phase 8: API Development
-- [ ] Create RESTful API for webhook source management
-- [ ] Implement API authentication and rate limiting
-- [ ] Add API documentation (OpenAPI/Swagger)
-- [ ] Create API client libraries
-- [ ] Implement webhooks-as-a-service API
-
-## Phase 9: Performance & Scalability
-- [ ] Implement caching layer (Redis)
-- [ ] Add background job processing (for retries, etc.)
-- [ ] Create horizontal scaling capabilities
-- [ ] Implement webhook delivery parallelization
-- [ ] Add metrics collection (Prometheus)
-- [ ] Create performance monitoring dashboard
-
-## Phase 10: Operations & Maintenance
-- [ ] Add comprehensive logging throughout application
-- [ ] Create admin dashboard for user management
-- [ ] Implement backup and restore procedures
-- [ ] Add system health checks and monitoring
-- [ ] Create deployment automation (Docker, K8s)
-- [ ] Implement zero-downtime deployments
-- [ ] Add feature flags for gradual rollouts
-
-## Nice-to-Have Features
-- [ ] Webhook marketplace/templates
-- [ ] Team collaboration features
-- [ ] Webhook versioning
-- [ ] A/B testing for webhooks
-- [ ] Webhook analytics export
-- [ ] Mobile app for monitoring
-- [ ] Slack/Discord/Email notifications
-- [ ] Webhook documentation generator
-- [ ] GraphQL subscription support
-- [ ] WebSocket support for real-time updates