feat: gadfly-reports — findings store + scoreboard daemon

SQLite-backed HTTP store for Gadfly review findings, per-review run timings, and human/Claude grades, with a points-free per-model scoreboard. Pure fact store: it computes no points or rankings (the dashboard maps severity->points client-side and retunes without re-scoring). Findings are content-addressed by location so cross-model reports collapse for consensus; one grade per finding, latest wins. Pure-Go SQLite (CGO-free) + Docker image CI + tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.env.example

@@ -0,0 +1,11 @@
+# === gadfly-reports daemon configuration ===
+
+# Listen address (default: :8090)
+GADFLY_REPORTS_ADDR=:8090
+
+# SQLite database path (default: gadfly-reports.db; /data/gadfly-reports.db in Docker)
+GADFLY_REPORTS_DB=/data/gadfly-reports.db
+
+# Bearer token callers must present on every route except /healthz (empty = open).
+# gadfly (emit) and gadfly-mcp must present the same token.
+GADFLY_REPORTS_TOKEN=change-me-to-a-secret