feat: add foundation layer (Go module, config, database, Docker)

Squashed commits from foundation-layer branch:

- Initialize Go module and project skeleton (cmd/naviwatcher/main.go)
- Add configuration management with YAML parsing and validation
- Add database layer with schema migrations (artist_settings, external_releases, notifications_sent)
- Add CRUD operations for artist_settings, external_releases, notifications_sent
- Add Docker setup with multi-stage build and docker-compose
- Verify acceptance criteria (tests, vet, fmt)
- Update README.md with build/run/test instructions
- Fix: filter ignored releases in GetUnnotifiedReleases (spec compliance)
- Fix: add FK constraint on notifications_sent.rgid
- Fix: add config.yaml to .gitignore (security)
- Fix: run Docker container as non-root user
- Fix: pin alpine:3.21 instead of alpine:latest
- Fix: wrap migrations in transactions for atomicity

All 49 tests pass, go vet clean, Docker image builds successfully.

internal/database/notifications.go

@@ -0,0 +1,69 @@
+package database
+
+import (
+	"fmt"
+)
+
+// MarkNotificationSent records that a notification has been sent for the given RGID.
+func MarkNotificationSent(db *DB, rgid string) error {
+	_, err := db.Conn().Exec(
+		"INSERT INTO notifications_sent (rgid) VALUES (?)",
+		rgid,
+	)
+	if err != nil {
+		return fmt.Errorf("mark notification sent: %w", err)
+	}
+	return nil
+}
+
+// IsNotificationSent checks whether a notification has already been sent for the given RGID.
+func IsNotificationSent(db *DB, rgid string) (bool, error) {
+	var count int
+	err := db.Conn().QueryRow(
+		"SELECT COUNT(*) FROM notifications_sent WHERE rgid = ?", rgid,
+	).Scan(&count)
+	if err != nil {
+		return false, fmt.Errorf("check notification sent: %w", err)
+	}
+	return count > 0, nil
+}
+
+// GetUnnotifiedReleases returns all external_release rows that have no entry in notifications_sent.
+func GetUnnotifiedReleases(db *DB) ([]ExternalRelease, error) {
+	rows, err := db.Conn().Query(`
+		SELECT e.rgid, e.artist_id, e.title, e.type, e.release_date, e.is_ignored
+		FROM external_releases e
+		LEFT JOIN notifications_sent n ON e.rgid = n.rgid
+		WHERE n.rgid IS NULL AND e.is_ignored = 0
+	`)
+	if err != nil {
+		return nil, fmt.Errorf("query unnotified releases: %w", err)
+	}
+	defer rows.Close()
+
+	var results []ExternalRelease
+	for rows.Next() {
+		var r ExternalRelease
+		if err := rows.Scan(&r.RGID, &r.ArtistID, &r.Title, &r.Type, &r.ReleaseDate, &r.IsIgnored); err != nil {
+			return nil, fmt.Errorf("scan unnotified release: %w", err)
+		}
+		results = append(results, r)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("iterate unnotified releases: %w", err)
+	}
+	return results, nil
+}
+
+// GetNotificationSentAt returns the sent_at time for a given RGID.
+// Returns sql.ErrNoRows if no notification has been sent.
+func GetNotificationSentAt(db *DB, rgid string) (string, error) {
+	var sentAt string
+	err := db.Conn().QueryRow(
+		"SELECT sent_at FROM notifications_sent WHERE rgid = ? ORDER BY sent_at DESC LIMIT 1", rgid,
+	).Scan(&sentAt)
+	if err != nil {
+		return "", err
+	}
+	return sentAt, nil
+}