Add buf lint/breaking targets and fix proto naming violations

- Add buf.yaml with STANDARD lint rules and FILE-level breaking change detection
- Add proto-lint Makefile target (buf lint + buf breaking --against master)
- Add lint Makefile target (golangci-lint) and include it in all
- Fix proto target: use module= option so protoc writes to gen/ not proto/
- engine.proto: rename rpc Request→Execute and message types accordingly
- acme.proto: drop redundant ACME prefix from SetConfig/ListAccounts/ListOrders messages
- policy.proto: add CreatePolicyResponse/GetPolicyResponse wrappers instead of returning PolicyRule directly from multiple RPCs
- Update grpcserver and webserver/client.go to match renamed types

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/grpcserver/acme.go

@@ -31,7 +31,7 @@ func (as *acmeServer) CreateEAB(ctx context.Context, req *pb.CreateEABRequest) (
 	return &pb.CreateEABResponse{Kid: cred.KID, HmacKey: cred.HMACKey}, nil
 }
 
-func (as *acmeServer) SetConfig(ctx context.Context, req *pb.SetACMEConfigRequest) (*pb.SetACMEConfigResponse, error) {
+func (as *acmeServer) SetConfig(ctx context.Context, req *pb.SetConfigRequest) (*pb.SetConfigResponse, error) {
 	if req.DefaultIssuer == "" {
 		return nil, status.Error(codes.InvalidArgument, "default_issuer is required")
 	}
@@ -46,10 +46,10 @@ func (as *acmeServer) SetConfig(ctx context.Context, req *pb.SetACMEConfigReques
 		as.s.logger.Error("grpc: acme set config", "error", err)
 		return nil, status.Error(codes.Internal, "failed to save config")
 	}
-	return &pb.SetACMEConfigResponse{Ok: true}, nil
+	return &pb.SetConfigResponse{Ok: true}, nil
 }
 
-func (as *acmeServer) ListAccounts(ctx context.Context, req *pb.ListACMEAccountsRequest) (*pb.ListACMEAccountsResponse, error) {
+func (as *acmeServer) ListAccounts(ctx context.Context, req *pb.ListAccountsRequest) (*pb.ListAccountsResponse, error) {
 	h, err := as.getOrCreateHandler(req.Mount)
 	if err != nil {
 		return nil, status.Error(codes.NotFound, "mount not found")
@@ -71,10 +71,10 @@ func (as *acmeServer) ListAccounts(ctx context.Context, req *pb.ListACMEAccounts
 			CreatedAt:     a.CreatedAt.String(),
 		})
 	}
-	return &pb.ListACMEAccountsResponse{Accounts: pbAccounts}, nil
+	return &pb.ListAccountsResponse{Accounts: pbAccounts}, nil
 }
 
-func (as *acmeServer) ListOrders(ctx context.Context, req *pb.ListACMEOrdersRequest) (*pb.ListACMEOrdersResponse, error) {
+func (as *acmeServer) ListOrders(ctx context.Context, req *pb.ListOrdersRequest) (*pb.ListOrdersResponse, error) {
 	h, err := as.getOrCreateHandler(req.Mount)
 	if err != nil {
 		return nil, status.Error(codes.NotFound, "mount not found")
@@ -99,7 +99,7 @@ func (as *acmeServer) ListOrders(ctx context.Context, req *pb.ListACMEOrdersRequ
 			ExpiresAt:   o.ExpiresAt.String(),
 		})
 	}
-	return &pb.ListACMEOrdersResponse{Orders: pbOrders}, nil
+	return &pb.ListOrdersResponse{Orders: pbOrders}, nil
 }
 
 func (as *acmeServer) getOrCreateHandler(mountName string) (*internacme.Handler, error) {

internal/grpcserver/engine.go

@@ -68,7 +68,7 @@ func (es *engineServer) ListMounts(_ context.Context, _ *pb.ListMountsRequest) (
 	return &pb.ListMountsResponse{Mounts: pbMounts}, nil
 }
 
-func (es *engineServer) Request(ctx context.Context, req *pb.EngineRequest) (*pb.EngineResponse, error) {
+func (es *engineServer) Execute(ctx context.Context, req *pb.ExecuteRequest) (*pb.ExecuteResponse, error) {
 	if req.Mount == "" || req.Operation == "" {
 		return nil, status.Error(codes.InvalidArgument, "mount and operation are required")
 	}
@@ -108,5 +108,5 @@ func (es *engineServer) Request(ctx context.Context, req *pb.EngineRequest) (*pb
 	if err != nil {
 		return nil, status.Error(codes.Internal, "failed to encode response")
 	}
-	return &pb.EngineResponse{Data: pbData}, nil
+	return &pb.ExecuteResponse{Data: pbData}, nil
 }

internal/grpcserver/policy.go

@@ -15,7 +15,7 @@ type policyServer struct {
 	s *GRPCServer
 }
 
-func (ps *policyServer) CreatePolicy(ctx context.Context, req *pb.CreatePolicyRequest) (*pb.PolicyRule, error) {
+func (ps *policyServer) CreatePolicy(ctx context.Context, req *pb.CreatePolicyRequest) (*pb.CreatePolicyResponse, error) {
 	if req.Rule == nil || req.Rule.Id == "" {
 		return nil, status.Error(codes.InvalidArgument, "rule.id is required")
 	}
@@ -24,7 +24,7 @@ func (ps *policyServer) CreatePolicy(ctx context.Context, req *pb.CreatePolicyRe
 		ps.s.logger.Error("grpc: create policy", "error", err)
 		return nil, status.Error(codes.Internal, "internal error")
 	}
-	return ruleToPB(rule), nil
+	return &pb.CreatePolicyResponse{Rule: ruleToPB(rule)}, nil
 }
 
 func (ps *policyServer) ListPolicies(ctx context.Context, _ *pb.ListPoliciesRequest) (*pb.ListPoliciesResponse, error) {
@@ -40,7 +40,7 @@ func (ps *policyServer) ListPolicies(ctx context.Context, _ *pb.ListPoliciesRequ
 	return &pb.ListPoliciesResponse{Rules: pbRules}, nil
 }
 
-func (ps *policyServer) GetPolicy(ctx context.Context, req *pb.GetPolicyRequest) (*pb.PolicyRule, error) {
+func (ps *policyServer) GetPolicy(ctx context.Context, req *pb.GetPolicyRequest) (*pb.GetPolicyResponse, error) {
 	if req.Id == "" {
 		return nil, status.Error(codes.InvalidArgument, "id is required")
 	}
@@ -48,7 +48,7 @@ func (ps *policyServer) GetPolicy(ctx context.Context, req *pb.GetPolicyRequest)
 	if err != nil {
 		return nil, status.Error(codes.NotFound, "not found")
 	}
-	return ruleToPB(rule), nil
+	return &pb.GetPolicyResponse{Rule: ruleToPB(rule)}, nil
 }
 
 func (ps *policyServer) DeletePolicy(ctx context.Context, req *pb.DeletePolicyRequest) (*pb.DeletePolicyResponse, error) {

internal/webserver/client.go

@@ -159,7 +159,7 @@ func (c *VaultClient) Mount(ctx context.Context, token, name, engineType string,
 
 // EngineRequest sends a generic engine operation to the vault.
 func (c *VaultClient) EngineRequest(ctx context.Context, token, mount, operation string, data map[string]interface{}) (map[string]interface{}, error) {
-	req := &pb.EngineRequest{
+	req := &pb.ExecuteRequest{
 		Mount:     mount,
 		Operation: operation,
 	}
@@ -170,7 +170,7 @@ func (c *VaultClient) EngineRequest(ctx context.Context, token, mount, operation
 		}
 		req.Data = s
 	}
-	resp, err := c.engine.Request(withToken(ctx, token), req)
+	resp, err := c.engine.Execute(withToken(ctx, token), req)
 	if err != nil {
 		return nil, err
 	}