ci: enforce lint locally via pre-commit hook

The repo had a .pre-commit-config.yaml entry for golangci-lint
already, but pinned to v1.61.0 — which doesn't grok the v2 schema
we just migrated to, so it would crash if anyone ever ran it. Hence
nobody did.

Replace the third-party hook blocks with local hooks that call
whatever tool is on the developer's PATH (gofumpt + go vet +
golangci-lint). That way the version of each tool tracks what the
developer would invoke by hand — no drift between hook config and
binary.

Add 'make setup' as a one-liner per-clone bootstrap:
  * installs gofumpt + golangci-lint via go install if missing
  * installs the pre-commit hooks via 'pre-commit install'

end-of-file-fixer auto-fixed two existing files (web/static/css/
styles.css and ask.md) — trailing newlines, harmless.

ask.md

@@ -5,4 +5,4 @@ All have restic installed on them
 I need to build a browser based management service that allows me to have a central single-plane-of-glass to monitor and manage all teh endpoints
 All endpoints will be enabled for SSH (unless other methods are better?)
 
-Plan out how we would go about this please?
+Plan out how we would go about this please?