feat. rebuild service in Go

Rebuild the Gitea Codex review bot from the product contract with a Go HTTP service, durable SQL queue, typed Gitea client, isolated runner, and deployment updates.

Co-Authored-By: Claude <noreply@anthropic.com>

Dockerfile

@@ -1,20 +1,22 @@
-FROM python:3.12-slim-bookworm
+FROM golang:1.25-bookworm AS build
 
-ENV PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1
-
-RUN apt-get update && apt-get install -y --no-install-recommends git docker.io ca-certificates && rm -rf /var/lib/apt/lists/*
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY cmd ./cmd
+COPY internal ./internal
+COPY migrations ./migrations
+RUN CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' -o /out/gitea-codex ./cmd/gitea-codex
 
+FROM debian:bookworm-slim
+ENV LANG=C.UTF-8
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates docker.io \
+    && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
-
-COPY pyproject.toml README.md /app/
-COPY src /app/src
-COPY alembic.ini /app/
-COPY alembic /app/alembic
-COPY docker/entrypoint.sh /app/docker/entrypoint.sh
-
-RUN pip install --no-cache-dir .
-RUN chmod +x /app/docker/entrypoint.sh
-
+COPY --from=build /out/gitea-codex /app/gitea-codex
+# The bot needs access to the mounted Docker API socket to launch runners.
+# Prefer a Docker socket proxy or a separate runner service in production.
+USER root
 EXPOSE 8000
-CMD ["/app/docker/entrypoint.sh"]
+ENTRYPOINT ["/app/gitea-codex"]