ci: add golangci-lint and go-mod-tidy to Go gate job

Go gate now runs: build, vet(dev+prod), golangci-lint, and go mod tidy check. Test and race jobs depend on this gate + vulns.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

.gitea/workflows/ci.yaml

@@ -18,7 +18,7 @@ env:
 
 jobs:
   vet:
-    name: Build & Vet
+    name: Go gate
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -58,6 +58,21 @@ jobs:
         run: go vet -tags "test,!dev" ./...
         working-directory: backend
 
+      - name: golangci-lint
+        run: |
+          go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
+          golangci-lint run ./...
+        working-directory: backend
+
+      - name: go mod tidy check
+        run: |
+          cp go.sum go.sum.bak
+          cp go.mod go.mod.bak
+          go mod tidy
+          diff -q go.sum go.sum.bak && diff -q go.mod go.mod.bak && echo "go.mod and go.sum up to date" || { echo "go.mod or go.sum out of date — run 'go mod tidy' and commit"; exit 1; }
+          rm -f go.sum.bak go.mod.bak
+        working-directory: backend
+
   test:
     name: Tests (${{ matrix.label }})
     needs: [vet, vulns]