p0: skeleton, dialer-Control URL guard, flake, Makefile

Go service with /healthz, SSRF guard (parse + resolve-all + Control),
exhaustive tests, NixOS module, and Makefile as source of truth for
build flags. nix flake check runs make test lint.

cmd/sift/main.go

@@ -0,0 +1,67 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"log/slog"
+	"net"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"git.wntrmute.dev/kyle/sift/internal/server"
+)
+
+// version is set by ldflags: -X main.version=…
+var version = "dev"
+
+func defaultConfigPath() string {
+	if p := os.Getenv("SIFT_CONFIG"); p != "" {
+		return p
+	}
+	return "/etc/sift/config.toml"
+}
+
+func main() {
+	listen := flag.String("listen", "127.0.0.1:8890", "listen address")
+	configPath := flag.String("config", defaultConfigPath(), "config file (optional in P0)")
+	showVersion := flag.Bool("version", false, "print version and exit")
+	flag.Parse()
+
+	if *showVersion {
+		fmt.Println(version)
+		os.Exit(0)
+	}
+
+	log := slog.New(slog.NewTextHandler(os.Stdout, nil))
+	if _, err := os.Stat(*configPath); err == nil {
+		log.Info("config file present but unused in P0", "path", *configPath)
+	}
+
+	srv := server.New(version)
+	hs := srv.HTTPServer(*listen)
+
+	ln, err := net.Listen("tcp", *listen)
+	if err != nil {
+		log.Error("listen", "err", err)
+		os.Exit(1)
+	}
+	log.Info("sift listening", "addr", ln.Addr().String(), "version", version)
+
+	errCh := make(chan error, 1)
+	go func() {
+		errCh <- hs.Serve(ln)
+	}()
+
+	sig := make(chan os.Signal, 1)
+	signal.Notify(sig, syscall.SIGINT, syscall.SIGTERM)
+	select {
+	case <-sig:
+		_ = hs.Close()
+	case err := <-errCh:
+		if err != nil {
+			log.Error("serve", "err", err)
+			os.Exit(1)
+		}
+	}
+}