Add race, gofmt, smoke-test, staticcheck, govulncheck, CodeQL to CI

[JeremiahM37]

Summary

Match librarr's CI hardening. Every PR is now gated on the same suite that protects librarr (see librarr commit 755c4a8).

What changed

.github/workflows/test.yml — replaces the bare go build + go test

• gofmt — fails the build if any file isn't gofmt'd (also runs gofmt -w . would fix locally)
• go build — binary compiles
• go test -race -count=1 -v — race detector + no cache
• go vet
• staticcheck (latest)
• govulncheck (latest) — scans against Go 1.25 stdlib so the 1.24.x stdlib CVEs that affect local runs disappear
• smoke test — boots the binary on port 15001 with DATA_DIR=/tmp/smoke-data, waits up to 15s for /api/health, then confirms the new /api/openapi.json and /torznab/api?t=caps endpoints respond. Greps boot log for panic/fatal.
• docker build job verifies the Dockerfile still produces an image.
• Bumped CI Go version to 1.25.x to match the Dockerfile. go.mod's 1.24.0 floor unchanged.

.github/workflows/codeql.yml — new

Security-and-quality queries, runs on push + PR + weekly cron (Mon 04:23 UTC). Surfaces post-merge dependency CVEs without manual intervention.

What had to be fixed for these gates to pass

• 26 files reformatted via gofmt -w . (no behavioral changes — just whitespace and import-block ordering).
• 3 staticcheck findings fixed:
  • internal/api/api.go:775 — for ... append(all, c) → append(all, custom...) (S1011)
  • internal/api/handlers_extra.go:248 — numeric 403 → http.StatusForbidden (ST1013)
  • internal/search/filter_test.go:238 — redundant nil check before len() (S1009)

Test plan

• Full gate sweep locally: gofmt clean, go vet clean, staticcheck clean, go test -race -count=1 ./... clean, govulncheck clean against the binary's actual build target (1.25), smoke test bound + /api/health, /api/openapi.json, /torznab/api?t=caps all return 200, no panic/fatal in boot log.
• 457 existing tests still pass.
• Docker build verified locally during the recent isolated-container deploy.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.