ci: add prod-tag variants to staticcheck and gosec

Both tools now run under test,dev and test,!dev tags, matching go-vet pattern.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

.gitea/workflows/ci.yaml

@@ -186,12 +186,17 @@ jobs:
           mkdir -p /opt/hostedtoolcache/node/22.23.1/x64/bin
           ln -sf /usr/local/bin/node /opt/hostedtoolcache/node/22.23.1/x64/bin/node
 
-      - name: Staticcheck
+      - name: Staticcheck (dev tags)
         run: |
           go install honnef.co/go/tools/cmd/staticcheck@latest
           staticcheck -tags "test,dev" ./...
         working-directory: backend
 
+      - name: Staticcheck (prod tags)
+        run: |
+          staticcheck -tags "test,!dev" ./...
+        working-directory: backend
+
   go-gosec:
     name: Security scan (gosec)
     needs: [go-build]
@@ -222,12 +227,17 @@ jobs:
           mkdir -p /opt/hostedtoolcache/node/22.23.1/x64/bin
           ln -sf /usr/local/bin/node /opt/hostedtoolcache/node/22.23.1/x64/bin/node
 
-      - name: gosec
+      - name: gosec (dev tags)
         run: |
           go install github.com/securego/gosec/v2/cmd/gosec@latest
           gosec -severity medium -tags "test,dev" ./...
         working-directory: backend
 
+      - name: gosec (prod tags)
+        run: |
+          gosec -severity medium -tags "test,!dev" ./...
+        working-directory: backend
+
   go-mod-tidy:
     name: go mod tidy
     needs: [go-build]