ci: add Gitea Actions pipeline, golangci-lint config, vuln target

- .gitea/workflows/ci.yml: lint, race tests (e2e excluded), and
  govulncheck on push to main and PRs; shared composite action installs
  protoc + pinned protoc-gen-go/protoc-gen-go-grpc and generates the
  (gitignored) protobuf code before each Go job.
- .golangci.yml (v2 schema): govet, staticcheck, errcheck, ineffassign,
  unused, misspell, gosec, revive; generated api/grpc/pb excluded.
- Makefile: vuln target (govulncheck) added and chained into qa.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.golangci.yml

@@ -0,0 +1,46 @@
+# golangci-lint configuration.
+#
+# Schema: golangci-lint v2 (this machine had no golangci-lint installed at
+# authoring time, so this targets the latest stable v2 config schema -
+# https://golangci-lint.run/usage/configuration/ - as of v2.12.x). If your
+# CI/local installs a v1 binary, upgrade it rather than downgrading this file;
+# v1 binaries do not understand `version: "2"` configs.
+version: "2"
+
+run:
+  timeout: 5m
+
+linters:
+  # Start from nothing and opt in explicitly, rather than `standard`/`all`,
+  # so the enabled set below is the complete, intentional list.
+  default: none
+
+  enable:
+    - govet      # suspicious constructs (vet)
+    - staticcheck # bugs, deprecated APIs, simplifications (includes old `gosimple`/`stylecheck` checks)
+    - errcheck   # unchecked error return values
+    - ineffassign # assignments that are never used
+    - unused     # unused constants, variables, functions, types
+    - misspell   # common English misspellings in comments/strings
+    - gosec      # security-focused static analysis
+    - revive     # style/lint rules (golint replacement)
+
+  settings:
+    gosec:
+      # G104 (unchecked errors) is already covered by errcheck above and is
+      # noisy/redundant when both linters are enabled together.
+      excludes:
+        - G104
+
+  exclusions:
+    # Generated protobuf code should never be linted or hand-edited. This is
+    # a plain path match against whatever is on disk at lint time, so it
+    # excludes api/grpc/pb/ whether or not the directory happens to exist -
+    # it's gitignored and regenerated by `make proto-gen` before CI lints
+    # (see .gitea/actions/generate-proto), not committed to the repo.
+    paths:
+      - api/grpc/pb/
+
+    # Keep the generated-code detector on too, in case other generated files
+    # show up elsewhere in the tree in the future.
+    generated: strict