ci: enforce lint locally via pre-commit hook

The repo had a .pre-commit-config.yaml entry for golangci-lint
already, but pinned to v1.61.0 — which doesn't grok the v2 schema
we just migrated to, so it would crash if anyone ever ran it. Hence
nobody did.

Replace the third-party hook blocks with local hooks that call
whatever tool is on the developer's PATH (gofumpt + go vet +
golangci-lint). That way the version of each tool tracks what the
developer would invoke by hand — no drift between hook config and
binary.

Add 'make setup' as a one-liner per-clone bootstrap:
  * installs gofumpt + golangci-lint via go install if missing
  * installs the pre-commit hooks via 'pre-commit install'

end-of-file-fixer auto-fixed two existing files (web/static/css/
styles.css and ask.md) — trailing newlines, harmless.

.pre-commit-config.yaml

@@ -11,15 +11,38 @@ repos:
       - id: mixed-line-ending
         args: ["--fix=lf"]
 
-  - repo: https://github.com/dnephin/pre-commit-golang
-    rev: v0.5.1
+  # Go-specific hooks. Local hooks (rather than third-party repos) so
+  # the version of each tool tracks whatever is on the developer's
+  # PATH, matching what they'd use to run the same checks by hand.
+  # Required tools:
+  #   * go            (toolchain matching go.mod)
+  #   * gofumpt       — `go install mvdan.cc/gofumpt@latest`
+  #   * golangci-lint — `go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6`
+  #
+  # Install + activate the hooks once per clone:
+  #   pre-commit install
+  - repo: local
     hooks:
-      - id: go-fmt
-      - id: go-imports
-      - id: go-vet-mod
-      - id: go-mod-tidy
+      - id: gofumpt
+        name: gofumpt
+        description: Format Go files with gofumpt (stricter superset of gofmt)
+        entry: gofumpt -l -w
+        language: system
+        types: [go]
+        pass_filenames: true
+
+      - id: go-vet
+        name: go vet
+        description: Run go vet across all packages
+        entry: go vet ./...
+        language: system
+        types: [go]
+        pass_filenames: false
 
-  - repo: https://github.com/golangci/golangci-lint
-    rev: v1.61.0
-    hooks:
       - id: golangci-lint
+        name: golangci-lint
+        description: Run golangci-lint against the whole module (matches CI)
+        entry: golangci-lint run ./...
+        language: system
+        types: [go]
+        pass_filenames: false

Makefile

@@ -20,7 +20,7 @@ TAILWIND_URL      := https://github.com/tailwindlabs/tailwindcss/releases/downlo
 TAILWIND_INPUT    := web/styles/input.css
 TAILWIND_OUTPUT   := web/static/css/styles.css
 
-.PHONY: help build server agent test test-race lint fmt tidy clean run-server run-agent docker release tailwind tailwind-watch
+.PHONY: help build server agent test test-race lint fmt tidy clean run-server run-agent docker release tailwind tailwind-watch setup hooks
 
 help:
 	@grep -E '^[a-zA-Z_-]+:.*?## ' $(MAKEFILE_LIST) | awk 'BEGIN{FS=":.*?## "};{printf "  \033[36m%-14s\033[0m %s\n",$$1,$$2}'
@@ -58,6 +58,15 @@ test-race: ## Run tests with the race detector
 lint: ## Run golangci-lint
 	golangci-lint run ./...
 
+setup: hooks ## One-time per-clone setup (Go tools + git hooks)
+	@command -v gofumpt >/dev/null 2>&1 || go install mvdan.cc/gofumpt@latest
+	@command -v golangci-lint >/dev/null 2>&1 || go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6
+	@echo "==> setup complete: gofumpt, golangci-lint, pre-commit hooks installed"
+
+hooks: ## Install the pre-commit hooks defined in .pre-commit-config.yaml
+	@command -v pre-commit >/dev/null 2>&1 || { echo "pre-commit not found — install with 'pip install pre-commit' or 'brew install pre-commit'" >&2; exit 1; }
+	pre-commit install
+
 fmt: ## Format with gofumpt + goimports
 	gofumpt -w .
 	goimports -local gitea.dcglab.co.uk/steve/restic-manager -w .