fix: address code review findings

- Add is_ignored=0 filter to GetUnnotifiedReleases query per spec section 4.4
  (notification lifecycle must exclude ignored releases)
- Add FK constraint on notifications_sent.rgid referencing external_releases(rgid)
  per spec schema definition
- Wrap migration application + recording in transactions for atomicity
- Add config.yaml to .gitignore to prevent accidental secret commits
- Pin Dockerfile base image to alpine:3.21 and add non-root appuser
- Add test TestGetUnnotifiedReleases_IgnoredExcluded

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/database/notifications.go

@@ -34,7 +34,7 @@ func GetUnnotifiedReleases(db *DB) ([]ExternalRelease, error) {
 		SELECT e.rgid, e.artist_id, e.title, e.type, e.release_date, e.is_ignored
 		FROM external_releases e
 		LEFT JOIN notifications_sent n ON e.rgid = n.rgid
-		WHERE n.rgid IS NULL
+		WHERE n.rgid IS NULL AND e.is_ignored = 0
 	`)
 	if err != nil {
 		return nil, fmt.Errorf("query unnotified releases: %w", err)