phase 0: project bootstrap

P0-01 Go module + cmd/server + cmd/agent skeletons + internal/ tree
P0-02 LICENSE (PolyForm NC 1.0.0), README, CONTRIBUTING
P0-03 golangci-lint, pre-commit, .editorconfig, .gitignore
P0-04 Gitea Actions CI: test (race+coverage), lint, cross-platform build matrix
P0-05 Dockerfile.server (multi-stage, distroless/static), docker-compose.yml
P0-06 Makefile with build/test/lint/fmt/run/release targets

build, vet, test, and cross-compile to linux/{amd64,arm64} + windows/amd64
all verified locally.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/Dockerfile.server

@@ -0,0 +1,37 @@
+# syntax=docker/dockerfile:1.7
+
+# ---- Build stage --------------------------------------------------------
+FROM golang:1.23-alpine AS build
+
+WORKDIR /src
+
+# Pure-Go SQLite (modernc.org/sqlite) means we can keep CGO off and build a
+# fully static binary that runs on distroless/static.
+ENV CGO_ENABLED=0 \
+    GOOS=linux \
+    GOFLAGS="-trimpath"
+
+# Cache module downloads in a separate layer.
+COPY go.mod go.sum* ./
+RUN go mod download
+
+COPY . .
+
+ARG VERSION=dev
+RUN go build -ldflags="-s -w -X main.version=${VERSION}" \
+    -o /out/restic-manager-server \
+    ./cmd/server
+
+# ---- Runtime stage ------------------------------------------------------
+FROM gcr.io/distroless/static-debian12:nonroot
+
+LABEL org.opencontainers.image.source="https://gitea.dcglab.co.uk/steve/restic-manager"
+LABEL org.opencontainers.image.licenses="PolyForm-Noncommercial-1.0.0"
+
+USER nonroot:nonroot
+WORKDIR /
+
+COPY --from=build /out/restic-manager-server /usr/local/bin/restic-manager-server
+
+EXPOSE 8443
+ENTRYPOINT ["/usr/local/bin/restic-manager-server"]

deploy/docker-compose.yml

@@ -0,0 +1,18 @@
+# Reference deployment for the restic-manager control plane.
+# Mirrors spec.md §10.1. Adjust image tag and RM_BASE_URL for your env.
+services:
+  restic-manager:
+    image: ghcr.io/dcglab/restic-manager:latest
+    restart: unless-stopped
+    ports:
+      - "8443:8443"
+    volumes:
+      - ./data:/data
+      - ./certs:/certs:ro
+    environment:
+      - RM_DATA_DIR=/data
+      - RM_LISTEN=:8443
+      - RM_BASE_URL=https://restic.lab.example
+      - RM_TLS_CERT=/certs/fullchain.pem
+      - RM_TLS_KEY=/certs/privkey.pem
+      - RM_SECRET_KEY_FILE=/data/secret.key