Add buf lint/breaking targets and fix proto naming violations

- Add buf.yaml with STANDARD lint rules and FILE-level breaking change detection
- Add proto-lint Makefile target (buf lint + buf breaking --against master)
- Add lint Makefile target (golangci-lint) and include it in all
- Fix proto target: use module= option so protoc writes to gen/ not proto/
- engine.proto: rename rpc Request→Execute and message types accordingly
- acme.proto: drop redundant ACME prefix from SetConfig/ListAccounts/ListOrders messages
- policy.proto: add CreatePolicyResponse/GetPolicyResponse wrappers instead of returning PolicyRule directly from multiple RPCs
- Update grpcserver and webserver/client.go to match renamed types

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Makefile

@@ -1,10 +1,10 @@
-.PHONY: build test vet clean docker all devserver metacrypt metacrypt-web proto
+.PHONY: build test vet lint proto-lint clean docker all devserver metacrypt metacrypt-web proto
 
 LDFLAGS := -trimpath -ldflags="-s -w -X main.version=$(shell git describe --tags --always --dirty 2>/dev/null || echo dev)"
 
 proto:
-	protoc --go_out=. --go_opt=paths=source_relative \
-		--go-grpc_out=. --go-grpc_opt=paths=source_relative \
+	protoc --go_out=. --go_opt=module=git.wntrmute.dev/kyle/metacrypt \
+		--go-grpc_out=. --go-grpc_opt=module=git.wntrmute.dev/kyle/metacrypt \
 		proto/metacrypt/v1/*.proto
 
 metacrypt:
@@ -22,6 +22,13 @@ test:
 vet:
 	go vet ./...
 
+lint:
+	golangci-lint run ./...
+
+proto-lint:
+	buf lint
+	buf breaking --against '.git#branch=master,subdir=proto'
+
 clean:
 	rm -f metacrypt metacrypt-web
 
@@ -35,4 +42,4 @@ devserver: metacrypt metacrypt-web
 	./metacrypt server --config srv/metacrypt.toml &
 	./metacrypt-web --config srv/metacrypt.toml
 
-all: vet test metacrypt metacrypt-web
+all: vet lint test metacrypt metacrypt-web