fix: address code review findings

- Add is_ignored=0 filter to GetUnnotifiedReleases query per spec section 4.4
  (notification lifecycle must exclude ignored releases)
- Add FK constraint on notifications_sent.rgid referencing external_releases(rgid)
  per spec schema definition
- Wrap migration application + recording in transactions for atomicity
- Add config.yaml to .gitignore to prevent accidental secret commits
- Pin Dockerfile base image to alpine:3.21 and add non-root appuser
- Add test TestGetUnnotifiedReleases_IgnoredExcluded

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/database/notifications_test.go

@@ -364,3 +364,44 @@ func TestMarkNotificationSent_MultipleReleases(t *testing.T) {
 		t.Errorf("expected 3 notification rows, got %d", count)
 	}
 }
+
+// TestGetUnnotifiedReleases_IgnoredExcluded verifies that releases marked as ignored
+// are not returned by GetUnnotifiedReleases, per the notification lifecycle spec (section 4.4).
+func TestGetUnnotifiedReleases_IgnoredExcluded(t *testing.T) {
+	db, err := New(":memory:")
+	if err != nil {
+		t.Fatalf("New() error: %v", err)
+	}
+	defer db.Close()
+
+	if err := insertTestArtist(db, "artist-1"); err != nil {
+		t.Fatalf("insertTestArtist: %v", err)
+	}
+
+	releases := []ExternalRelease{
+		{RGID: "rg1", ArtistID: "artist-1", Title: "Normal Album", Type: "album", ReleaseDate: "2024-01-01", IsIgnored: false},
+		{RGID: "rg2", ArtistID: "artist-1", Title: "Ignored Album", Type: "album", ReleaseDate: "2024-06-01", IsIgnored: true},
+		{RGID: "rg3", ArtistID: "artist-1", Title: "Another Normal", Type: "single", ReleaseDate: "2024-03-01", IsIgnored: false},
+	}
+
+	for _, r := range releases {
+		if err := SaveExternalRelease(db, &r); err != nil {
+			t.Fatalf("SaveExternalRelease(%s) error: %v", r.RGID, err)
+		}
+	}
+
+	results, err := GetUnnotifiedReleases(db)
+	if err != nil {
+		t.Fatalf("GetUnnotifiedReleases() error: %v", err)
+	}
+	if len(results) != 2 {
+		t.Fatalf("expected 2 unnotified releases (ignored excluded), got %d", len(results))
+	}
+
+	// Verify the ignored release is not in the results.
+	for _, r := range results {
+		if r.RGID == "rg2" {
+			t.Error("ignored release rg2 should not appear in unnotified releases")
+		}
+	}
+}