feat: add foundation layer (Go module, config, database, Docker)

Squashed commits from foundation-layer branch:

- Initialize Go module and project skeleton (cmd/naviwatcher/main.go)
- Add configuration management with YAML parsing and validation
- Add database layer with schema migrations (artist_settings, external_releases, notifications_sent)
- Add CRUD operations for artist_settings, external_releases, notifications_sent
- Add Docker setup with multi-stage build and docker-compose
- Verify acceptance criteria (tests, vet, fmt)
- Update README.md with build/run/test instructions
- Fix: filter ignored releases in GetUnnotifiedReleases (spec compliance)
- Fix: add FK constraint on notifications_sent.rgid
- Fix: add config.yaml to .gitignore (security)
- Fix: run Docker container as non-root user
- Fix: pin alpine:3.21 instead of alpine:latest
- Fix: wrap migrations in transactions for atomicity

All 49 tests pass, go vet clean, Docker image builds successfully.

cmd/naviwatcher/main.go

@@ -0,0 +1,54 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"log"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"naviwatcher/internal/config"
+)
+
+const defaultConfigPath = "config.yaml"
+
+func main() {
+	configPath := flag.String("config", defaultConfigPath, "Path to config file")
+	flag.Parse()
+
+	log.Println("NaviWatcher starting...")
+
+	cfg, err := config.LoadConfig(*configPath)
+	if err != nil {
+		log.Fatalf("Failed to load config: %v", err)
+	}
+
+	log.Printf("Config loaded from %s (server: %s:%d)", *configPath, cfg.Server.Host, cfg.Server.Port)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	sigCh := make(chan os.Signal, 1)
+	signal.Notify(sigCh, syscall.SIGINT, syscall.SIGTERM)
+
+	go func() {
+		sig := <-sigCh
+		log.Printf("Received signal %v, shutting down...", sig)
+		cancel()
+	}()
+
+	if err := run(ctx, cfg); err != nil {
+		log.Fatalf("Application error: %v", err)
+	}
+
+	log.Println("NaviWatcher stopped.")
+}
+
+func run(ctx context.Context, cfg *config.Config) error {
+	// Main application loop — blocks until context is cancelled.
+	// Business logic will be added in future tasks.
+	<-ctx.Done()
+
+	return nil
+}

cmd/naviwatcher/main_test.go

@@ -0,0 +1,56 @@
+package main
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"naviwatcher/internal/config"
+)
+
+func TestRun_GracefulShutdown(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	cfg := &config.Config{}
+	if err := run(ctx, cfg); err != nil {
+		t.Fatalf("run returned error: %v", err)
+	}
+}
+
+func TestConfigIntegration(t *testing.T) {
+	// Integration test: write a minimal valid config and load it via config.LoadConfig,
+	// verifying the full path that main() uses.
+	dir := t.TempDir()
+	path := filepath.Join(dir, "config.yaml")
+
+	yaml := `server:
+  host: "127.0.0.1"
+  port: 9090
+navidrome:
+  url: "http://localhost:4533"
+  user: "test"
+  password: "test"
+musicbrainz:
+  user_agent: "NaviWatcher/1.0 ( test@example.com )"
+`
+	if err := os.WriteFile(path, []byte(yaml), 0644); err != nil {
+		t.Fatalf("failed to write config: %v", err)
+	}
+
+	cfg, err := config.LoadConfig(path)
+	if err != nil {
+		t.Fatalf("LoadConfig returned error: %v", err)
+	}
+
+	if cfg.Server.Host != "127.0.0.1" {
+		t.Errorf("expected host 127.0.0.1, got %q", cfg.Server.Host)
+	}
+	if cfg.Server.Port != 9090 {
+		t.Errorf("expected port 9090, got %d", cfg.Server.Port)
+	}
+	if cfg.Navidrome.URL != "http://localhost:4533" {
+		t.Errorf("expected navidrome url http://localhost:4533, got %q", cfg.Navidrome.URL)
+	}
+}