ci: add Gitea Actions pipeline, golangci-lint config, vuln target

- .gitea/workflows/ci.yml: lint, race tests (e2e excluded), and
  govulncheck on push to main and PRs; shared composite action installs
  protoc + pinned protoc-gen-go/protoc-gen-go-grpc and generates the
  (gitignored) protobuf code before each Go job.
- .golangci.yml (v2 schema): govet, staticcheck, errcheck, ineffassign,
  unused, misspell, gosec, revive; generated api/grpc/pb excluded.
- Makefile: vuln target (govulncheck) added and chained into qa.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -0,0 +1,113 @@
+name: CI
+
+# Gitea Actions reads workflows from .gitea/workflows/ and executes them with
+# a GitHub-Actions-compatible engine (act_runner). Standard actions/* steps
+# work as long as the runner can resolve github.com (either directly or via a
+# configured actions mirror on the Gitea instance) - see notes at the bottom
+# of this file for offline/mirrored setups.
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+# Cancel superseded runs for the same ref to save runner capacity.
+# Gitea Actions accepts both the `gitea.*` and `github.*` context aliases;
+# `github.*` is used here since it's the more portable spelling.
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      # api/grpc/pb/ is gitignored and generated at build time (see
+      # .gitignore and the Dockerfile), so anything that compiles this
+      # module - including the linter, which type-checks packages - needs
+      # the generated code in place first.
+      - name: Generate protobuf code
+        uses: ./.gitea/actions/generate-proto
+
+      # Installing the pinned binary via the official install script is more
+      # portable across Gitea Actions runner images than golangci-lint-action,
+      # which assumes a GitHub-hosted runner environment (it works, but the
+      # install script approach has fewer surprises on self-hosted runners
+      # and lets us pin an exact version without depending on the action's
+      # own release cadence).
+      - name: Install golangci-lint
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | \
+            sh -s -- -b "$(go env GOPATH)/bin" v2.12.2
+          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+
+      - name: Run golangci-lint
+        run: golangci-lint run ./...
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      # api/grpc/pb/ is gitignored and generated at build time; without this
+      # the module won't compile (pkg/client, internal/service, etc. import
+      # the generated package).
+      - name: Generate protobuf code
+        uses: ./.gitea/actions/generate-proto
+
+      # tests/e2e uses testcontainers-go and requires a Docker daemon that
+      # isn't guaranteed to be available/usable on Gitea Actions runners, so
+      # it is excluded from CI here via `go list ... | grep -v`. Run it
+      # locally (or on a runner with Docker-in-Docker configured) with:
+      #   go test -race ./tests/e2e/...
+      - name: Run tests (excluding e2e)
+        run: |
+          go test -race -covermode=atomic -coverprofile=coverage.out \
+            $(go list ./... | grep -v '/tests/e2e')
+        # coverage.out is left in the workspace for inspection; artifact
+        # upload is intentionally omitted since actions/upload-artifact
+        # support varies by Gitea version/configuration - add it back once
+        # your instance's artifact storage is confirmed working.
+
+  vuln:
+    name: Vulnerability scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      # govulncheck also loads and type-checks the module's packages, so the
+      # generated protobuf code has to exist first.
+      - name: Generate protobuf code
+        uses: ./.gitea/actions/generate-proto
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Run govulncheck
+        run: govulncheck ./...