p0: skeleton, dialer-Control URL guard, flake, Makefile

Go service with /healthz, SSRF guard (parse + resolve-all + Control),
exhaustive tests, NixOS module, and Makefile as source of truth for
build flags. nix flake check runs make test lint.

dist/sift.toml.example

@@ -0,0 +1,13 @@
+# sift configuration. P0 only uses -listen; remaining keys are reserved for P1+.
+# This file is an example: the service does not assume Nix store paths.
+
+listen = "127.0.0.1:8890"
+
+# [upstreams]
+# searxng = "http://127.0.0.1:8888"
+# dixie   = "http://dixie.scylla-hammerhead.ts.net:11434/v1"
+# honcho  = "http://rift.scylla-hammerhead.ts.net:8000"
+
+# [digest]
+# model = "ornith-1.5-9b-uncensored"
+# thinking = false