feat: add foundation layer (Go module, config, database, Docker)

Squashed commits from foundation-layer branch:

- Initialize Go module and project skeleton (cmd/naviwatcher/main.go)
- Add configuration management with YAML parsing and validation
- Add database layer with schema migrations (artist_settings, external_releases, notifications_sent)
- Add CRUD operations for artist_settings, external_releases, notifications_sent
- Add Docker setup with multi-stage build and docker-compose
- Verify acceptance criteria (tests, vet, fmt)
- Update README.md with build/run/test instructions
- Fix: filter ignored releases in GetUnnotifiedReleases (spec compliance)
- Fix: add FK constraint on notifications_sent.rgid
- Fix: add config.yaml to .gitignore (security)
- Fix: run Docker container as non-root user
- Fix: pin alpine:3.21 instead of alpine:latest
- Fix: wrap migrations in transactions for atomicity

All 49 tests pass, go vet clean, Docker image builds successfully.

Dockerfile

@@ -0,0 +1,34 @@
+# Build stage
+FROM golang:1.25-alpine AS builder
+
+RUN apk add --no-cache gcc musl-dev
+
+WORKDIR /app
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+RUN CGO_ENABLED=1 GOOS=linux go build -o naviwatcher ./cmd/naviwatcher
+
+# Runtime stage
+FROM alpine:3.21
+
+RUN apk add --no-cache ca-certificates sqlite-libs && \
+    adduser -D -g '' appuser
+
+WORKDIR /app
+
+COPY --from=builder /app/naviwatcher .
+
+RUN chown appuser:appuser /app
+
+EXPOSE 8080
+
+VOLUME ["/app/data"]
+
+USER appuser
+
+ENTRYPOINT ["./naviwatcher"]
+CMD ["-config=/app/data/config.yaml"]