phase 0: project bootstrap

P0-01 Go module + cmd/server + cmd/agent skeletons + internal/ tree
P0-02 LICENSE (PolyForm NC 1.0.0), README, CONTRIBUTING
P0-03 golangci-lint, pre-commit, .editorconfig, .gitignore
P0-04 Gitea Actions CI: test (race+coverage), lint, cross-platform build matrix
P0-05 Dockerfile.server (multi-stage, distroless/static), docker-compose.yml
P0-06 Makefile with build/test/lint/fmt/run/release targets

build, vet, test, and cross-compile to linux/{amd64,arm64} + windows/amd64
all verified locally.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/agent/runner/doc.go

@@ -0,0 +1,3 @@
+// Package runner spawns restic processes, parses their --json output
+// stream, and forwards events to the server over WebSocket.
+package runner

internal/agent/scheduler/doc.go

@@ -0,0 +1,4 @@
+// Package scheduler runs the agent's local cron loop. The server is the
+// source of truth for schedules; this package reconciles to whatever
+// the server most recently pushed.
+package scheduler

internal/agent/service/doc.go

@@ -0,0 +1,3 @@
+// Package service wires the agent into the host's service manager
+// (systemd on Linux, the Service Control Manager on Windows).
+package service

internal/api/doc.go

@@ -0,0 +1,4 @@
+// Package api defines shared types for the control-plane API:
+// REST request/response shapes (server ↔ browser) and WebSocket
+// message envelopes (server ↔ agent). See spec.md §6.
+package api

internal/auth/doc.go

@@ -0,0 +1,3 @@
+// Package auth handles password hashing (argon2id), session cookies,
+// CSRF tokens, and bearer-token verification for agents.
+package auth

internal/crypto/doc.go

@@ -0,0 +1,3 @@
+// Package crypto wraps AEAD encryption used to protect repo passwords,
+// REST-server credentials, and pre/post hook bodies at rest.
+package crypto

internal/restic/doc.go

@@ -0,0 +1,3 @@
+// Package restic wraps the restic CLI: locating the binary, invoking
+// it with --json, and parsing the streamed event payloads.
+package restic

internal/server/http/doc.go

@@ -0,0 +1,2 @@
+// Package http hosts the chi-based REST handlers for the control plane.
+package http

internal/server/ui/doc.go

@@ -0,0 +1,3 @@
+// Package ui renders the HTMX/Tailwind frontend from server-side
+// html/templates.
+package ui

internal/server/ws/doc.go

@@ -0,0 +1,3 @@
+// Package ws hosts the WebSocket transport for agent ↔ server and the
+// browser-facing live job log stream.
+package ws

internal/store/doc.go

@@ -0,0 +1,3 @@
+// Package store is the SQLite persistence layer
+// (modernc.org/sqlite, no CGo).
+package store