feat. rebuild service in Go

Rebuild the Gitea Codex review bot from the product contract with a Go HTTP service, durable SQL queue, typed Gitea client, isolated runner, and deployment updates.

Co-Authored-By: Claude <noreply@anthropic.com>

docs/go-rebuild.md

@@ -0,0 +1,15 @@
+# Go rebuild notes
+
+The service was rebuilt from the product behavior rather than ported module-for-module from the previous Python implementation. The Go code keeps the durable table names and public webhook/health contracts while separating domain decisions from HTTP, SQL, Gitea, Docker, and Codex concerns.
+
+## Deliberate differences
+
+- There is no host-side review fallback. Runner failure is a failed attempt and is retried according to queue policy.
+- Review result output is validated strictly and bounded before persistence or posting.
+- The landing and 404 pages are embedded and do not load Tailwind from a third-party CDN.
+- The current tested append-comment behavior is retained: each completed review posts a new comment and updates the latest `bot_comments` mapping.
+- Docker execution is treated as a privileged deployment boundary. The bundled image runs the bot as root because direct Docker-socket access otherwise fails; production should replace this with a socket proxy or separate runner service, pinned images, resource limits, and least-privilege credentials.
+
+## Migration compatibility
+
+The Go startup migrator creates the logical `webhook_events`, `review_jobs`, `review_runs`, and `bot_comments` schema and preserves `trigger_comment_body`. Existing deployments should be backed up before switching binaries. The first Go release does not drop old columns or tables.