feat: add foundation layer (Go module, config, database, Docker)

Squashed commits from foundation-layer branch:

- Initialize Go module and project skeleton (cmd/naviwatcher/main.go)
- Add configuration management with YAML parsing and validation
- Add database layer with schema migrations (artist_settings, external_releases, notifications_sent)
- Add CRUD operations for artist_settings, external_releases, notifications_sent
- Add Docker setup with multi-stage build and docker-compose
- Verify acceptance criteria (tests, vet, fmt)
- Update README.md with build/run/test instructions
- Fix: filter ignored releases in GetUnnotifiedReleases (spec compliance)
- Fix: add FK constraint on notifications_sent.rgid
- Fix: add config.yaml to .gitignore (security)
- Fix: run Docker container as non-root user
- Fix: pin alpine:3.21 instead of alpine:latest
- Fix: wrap migrations in transactions for atomicity

All 49 tests pass, go vet clean, Docker image builds successfully.

README.md

@@ -28,7 +28,7 @@ NaviWatcher is an autonomous service daemon that monitors your Navidrome music c
 
 ### Technology Stack
 
-- **Language:** Go 1.21+
+- **Language:** Go 1.25+
 - **Database:** SQLite 3
 - **HTTP Server:** Go standard library (`net/http` + `html/template`)
 - **Key dependencies:**
@@ -69,12 +69,12 @@ server:
   host: "0.0.0.0"
   port: 8080
   username: "admin"
-  password: "password123"
+  password: "CHANGE_ME"
 
 navidrome:
   url: "http://localhost:4533"
   user: "watcher_service"
-  password: "user_password"
+  password: "CHANGE_ME"
 
 musicbrainz:
   user_agent: "NaviWatcher/1.0 ( mail@example.com )"
@@ -176,12 +176,12 @@ server:
   host: "0.0.0.0"
   port: 8080
   username: "admin"
-  password: "password123"
+  password: "CHANGE_ME"
 
 navidrome:
   url: "http://localhost:4533"
   user: "watcher_service"
-  password: "user_password"
+  password: "CHANGE_ME"
 
 musicbrainz:
   user_agent: "NaviWatcher/1.0 ( mail@example.com )"