feat: add foundation layer (Go module, config, database, Docker)

Squashed commits from foundation-layer branch:

- Initialize Go module and project skeleton (cmd/naviwatcher/main.go)
- Add configuration management with YAML parsing and validation
- Add database layer with schema migrations (artist_settings, external_releases, notifications_sent)
- Add CRUD operations for artist_settings, external_releases, notifications_sent
- Add Docker setup with multi-stage build and docker-compose
- Verify acceptance criteria (tests, vet, fmt)
- Update README.md with build/run/test instructions
- Fix: filter ignored releases in GetUnnotifiedReleases (spec compliance)
- Fix: add FK constraint on notifications_sent.rgid
- Fix: add config.yaml to .gitignore (security)
- Fix: run Docker container as non-root user
- Fix: pin alpine:3.21 instead of alpine:latest
- Fix: wrap migrations in transactions for atomicity

All 49 tests pass, go vet clean, Docker image builds successfully.

internal/database/external_releases.go

@@ -0,0 +1,101 @@
+package database
+
+import (
+	"fmt"
+)
+
+// GetExternalRelease retrieves an external_release row by RGID.
+// Returns sql.ErrNoRows if the release is not found.
+func GetExternalRelease(db *DB, rgid string) (*ExternalRelease, error) {
+	var r ExternalRelease
+	err := db.Conn().QueryRow(
+		"SELECT rgid, artist_id, title, type, release_date, is_ignored FROM external_releases WHERE rgid = ?",
+		rgid,
+	).Scan(&r.RGID, &r.ArtistID, &r.Title, &r.Type, &r.ReleaseDate, &r.IsIgnored)
+	if err != nil {
+		return nil, err
+	}
+	return &r, nil
+}
+
+// SaveExternalRelease inserts or replaces an external_release row.
+func SaveExternalRelease(db *DB, release *ExternalRelease) error {
+	_, err := db.Conn().Exec(
+		"INSERT OR REPLACE INTO external_releases (rgid, artist_id, title, type, release_date, is_ignored) VALUES (?, ?, ?, ?, ?, ?)",
+		release.RGID, release.ArtistID, release.Title, release.Type, release.ReleaseDate, release.IsIgnored,
+	)
+	if err != nil {
+		return fmt.Errorf("save external release: %w", err)
+	}
+	return nil
+}
+
+// GetExternalReleasesByArtist returns all external_release rows for a given artist_id.
+func GetExternalReleasesByArtist(db *DB, artistID string) ([]ExternalRelease, error) {
+	rows, err := db.Conn().Query(
+		"SELECT rgid, artist_id, title, type, release_date, is_ignored FROM external_releases WHERE artist_id = ?",
+		artistID,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("query external releases by artist: %w", err)
+	}
+	defer rows.Close()
+
+	var results []ExternalRelease
+	for rows.Next() {
+		var r ExternalRelease
+		if err := rows.Scan(&r.RGID, &r.ArtistID, &r.Title, &r.Type, &r.ReleaseDate, &r.IsIgnored); err != nil {
+			return nil, fmt.Errorf("scan external release: %w", err)
+		}
+		results = append(results, r)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("iterate external releases: %w", err)
+	}
+	return results, nil
+}
+
+// GetIgnoredReleases returns all external_release rows where is_ignored = 1.
+func GetIgnoredReleases(db *DB) ([]ExternalRelease, error) {
+	rows, err := db.Conn().Query(
+		"SELECT rgid, artist_id, title, type, release_date, is_ignored FROM external_releases WHERE is_ignored = 1",
+	)
+	if err != nil {
+		return nil, fmt.Errorf("query ignored releases: %w", err)
+	}
+	defer rows.Close()
+
+	var results []ExternalRelease
+	for rows.Next() {
+		var r ExternalRelease
+		if err := rows.Scan(&r.RGID, &r.ArtistID, &r.Title, &r.Type, &r.ReleaseDate, &r.IsIgnored); err != nil {
+			return nil, fmt.Errorf("scan ignored release: %w", err)
+		}
+		results = append(results, r)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("iterate ignored releases: %w", err)
+	}
+	return results, nil
+}
+
+// SetReleaseIgnored updates the is_ignored flag for a given RGID.
+func SetReleaseIgnored(db *DB, rgid string, ignored bool) error {
+	result, err := db.Conn().Exec(
+		"UPDATE external_releases SET is_ignored = ? WHERE rgid = ?",
+		ignored, rgid,
+	)
+	if err != nil {
+		return fmt.Errorf("set release ignored: %w", err)
+	}
+
+	rowsAffected, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("rows affected: %w", err)
+	}
+	if rowsAffected == 0 {
+		return fmt.Errorf("release not found: %s", rgid)
+	}
+
+	return nil
+}