fix: address code review findings

- Add is_ignored=0 filter to GetUnnotifiedReleases query per spec section 4.4
  (notification lifecycle must exclude ignored releases)
- Add FK constraint on notifications_sent.rgid referencing external_releases(rgid)
  per spec schema definition
- Wrap migration application + recording in transactions for atomicity
- Add config.yaml to .gitignore to prevent accidental secret commits
- Pin Dockerfile base image to alpine:3.21 and add non-root appuser
- Add test TestGetUnnotifiedReleases_IgnoredExcluded

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Dockerfile

@@ -13,17 +13,22 @@ COPY . .
 RUN CGO_ENABLED=1 GOOS=linux go build -o naviwatcher ./cmd/naviwatcher
 
 # Runtime stage
-FROM alpine:latest
+FROM alpine:3.21
 
-RUN apk add --no-cache ca-certificates sqlite-libs
+RUN apk add --no-cache ca-certificates sqlite-libs && \
+    adduser -D -g '' appuser
 
 WORKDIR /app
 
 COPY --from=builder /app/naviwatcher .
 
+RUN chown appuser:appuser /app
+
 EXPOSE 8080
 
 VOLUME ["/app/data"]
 
+USER appuser
+
 ENTRYPOINT ["./naviwatcher"]
 CMD ["-config=/app/data/config.yaml"]