feat: scaffold project with config, store, health endpoint, CI, and Dockerfile

Phase 1 of foreman: initialize the Go module, project layout, and core
infrastructure. Includes env-based configuration (FOREMAN_* namespace),
SQLite-backed durable job queue with WAL mode via modernc.org/sqlite,
stdlib HTTP server with /healthz and optional bearer-token auth middleware,
subcommand dispatch (serve + stubs), Gitea CI workflow, multi-stage
distroless Dockerfile, and comprehensive tests for all packages.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/config/config.go

@@ -0,0 +1,81 @@
+// Package config loads foreman's runtime configuration from environment variables.
+//
+// Why: centralizes all env-based configuration into a single, validated struct so
+// callers never read raw env vars directly.
+// What: reads FOREMAN_* environment variables, applies defaults, and validates
+// required values.
+// Test: set required env vars, call Load(), assert fields match; omit required vars,
+// assert Load() returns an error.
+package config
+
+import (
+	"fmt"
+	"os"
+	"time"
+)
+
+// Config holds all runtime configuration for the foreman daemon.
+type Config struct {
+	// Addr is the listen address for the HTTP server (default ":8080").
+	Addr string
+
+	// OllamaURL is the base URL of the Ollama target (required).
+	OllamaURL string
+
+	// OllamaToken is an optional bearer token sent to the Ollama target.
+	OllamaToken string
+
+	// Token is an optional bearer token that callers must present to foreman.
+	Token string
+
+	// EmbedModel is the always-resident embedder model name (e.g. "nomic-embed-text").
+	EmbedModel string
+
+	// DBPath is the path to the SQLite database file (default "foreman.db").
+	DBPath string
+
+	// PollInterval controls how often the model poller hits the target (default 30s).
+	PollInterval time.Duration
+
+	// WebhookSecret is an optional HMAC key for signing webhook payloads.
+	WebhookSecret string
+}
+
+// Load reads configuration from environment variables and returns a validated Config.
+//
+// Why: provides a single entry point for configuration with sensible defaults.
+// What: reads FOREMAN_* env vars, applies defaults, validates required fields.
+// Test: call with FOREMAN_OLLAMA_URL set, assert success; call without it, assert error.
+func Load() (Config, error) {
+	cfg := Config{
+		Addr:          envOr("FOREMAN_ADDR", ":8080"),
+		OllamaURL:     os.Getenv("FOREMAN_OLLAMA_URL"),
+		OllamaToken:   os.Getenv("FOREMAN_OLLAMA_TOKEN"),
+		Token:         os.Getenv("FOREMAN_TOKEN"),
+		EmbedModel:    os.Getenv("FOREMAN_EMBED_MODEL"),
+		DBPath:        envOr("FOREMAN_DB_PATH", "foreman.db"),
+		WebhookSecret: os.Getenv("FOREMAN_WEBHOOK_SECRET"),
+	}
+
+	pollStr := envOr("FOREMAN_POLL_INTERVAL", "30s")
+	dur, err := time.ParseDuration(pollStr)
+	if err != nil {
+		return Config{}, fmt.Errorf("invalid FOREMAN_POLL_INTERVAL %q: %w", pollStr, err)
+	}
+	cfg.PollInterval = dur
+
+	if cfg.OllamaURL == "" {
+		return Config{}, fmt.Errorf("FOREMAN_OLLAMA_URL is required")
+	}
+
+	return cfg, nil
+}
+
+// envOr returns the value of the environment variable named by key, or fallback
+// if the variable is empty or unset.
+func envOr(key, fallback string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return fallback
+}