ci: add Gitea Actions pipeline, golangci-lint config, vuln target

- .gitea/workflows/ci.yml: lint, race tests (e2e excluded), and
  govulncheck on push to main and PRs; shared composite action installs
  protoc + pinned protoc-gen-go/protoc-gen-go-grpc and generates the
  (gitignored) protobuf code before each Go job.
- .golangci.yml (v2 schema): govet, staticcheck, errcheck, ineffassign,
  unused, misspell, gosec, revive; generated api/grpc/pb excluded.
- Makefile: vuln target (govulncheck) added and chained into qa.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Makefile

@@ -1,4 +1,4 @@
-.PHONY: proto proto-gen proto-clean deps build build-dev run run-grpc run-rest test lint fmt vet check docker-build docker-build-dev docker-buildx-setup docker-run clean help
+.PHONY: proto proto-gen proto-clean deps build build-dev run run-grpc run-rest test lint vuln fmt vet check docker-build docker-build-dev docker-buildx-setup docker-run clean help
 
 # Variables
 REGISTRY ?=
@@ -137,8 +137,15 @@ lint:
 	golangci-lint run ./...
 	@echo "Linting passed"
 
+# Run vulnerability scan (requires govulncheck)
+vuln:
+	@echo "Running vulnerability scan..."
+	@which govulncheck > /dev/null || (echo "govulncheck not installed. Run: go install golang.org/x/vuln/cmd/govulncheck@latest" && exit 1)
+	govulncheck ./...
+	@echo "Vulnerability scan passed"
+
 # Run all quality checks
-qa: fmt vet lint test
+qa: fmt vet lint vuln test
 	@echo "All quality checks passed!"
 
 # Build Docker image (production - optimized)