Add buf lint/breaking targets and fix proto naming violations

- Add buf.yaml with STANDARD lint rules and FILE-level breaking change detection
- Add proto-lint Makefile target (buf lint + buf breaking --against master)
- Add lint Makefile target (golangci-lint) and include it in all
- Fix proto target: use module= option so protoc writes to gen/ not proto/
- engine.proto: rename rpc Request→Execute and message types accordingly
- acme.proto: drop redundant ACME prefix from SetConfig/ListAccounts/ListOrders messages
- policy.proto: add CreatePolicyResponse/GetPolicyResponse wrappers instead of returning PolicyRule directly from multiple RPCs
- Update grpcserver and webserver/client.go to match renamed types

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

proto/metacrypt/v1/acme.proto

@@ -16,13 +16,13 @@ service ACMEService {
 
   // SetConfig sets the ACME configuration for a CA mount.
   // Currently configures the default issuer used for ACME certificate issuance.
-  rpc SetConfig(SetACMEConfigRequest) returns (SetACMEConfigResponse);
+  rpc SetConfig(SetConfigRequest) returns (SetConfigResponse);
 
   // ListAccounts returns all ACME accounts for a CA mount. Admin only.
-  rpc ListAccounts(ListACMEAccountsRequest) returns (ListACMEAccountsResponse);
+  rpc ListAccounts(ListAccountsRequest) returns (ListAccountsResponse);
 
   // ListOrders returns all ACME orders for a CA mount. Admin only.
-  rpc ListOrders(ListACMEOrdersRequest) returns (ListACMEOrdersResponse);
+  rpc ListOrders(ListOrdersRequest) returns (ListOrdersResponse);
 }
 
 message CreateEABRequest {
@@ -37,22 +37,22 @@ message CreateEABResponse {
   bytes hmac_key = 2;
 }
 
-message SetACMEConfigRequest {
+message SetConfigRequest {
   string mount = 1;
   // default_issuer is the name of the CA issuer to use for ACME certificates.
   // The issuer must already exist on the CA mount.
   string default_issuer = 2;
 }
 
-message SetACMEConfigResponse {
+message SetConfigResponse {
   bool ok = 1;
 }
 
-message ListACMEAccountsRequest {
+message ListAccountsRequest {
   string mount = 1;
 }
 
-message ListACMEAccountsResponse {
+message ListAccountsResponse {
   repeated ACMEAccount accounts = 1;
 }
 
@@ -64,11 +64,11 @@ message ACMEAccount {
   string created_at = 5;
 }
 
-message ListACMEOrdersRequest {
+message ListOrdersRequest {
   string mount = 1;
 }
 
-message ListACMEOrdersResponse {
+message ListOrdersResponse {
   repeated ACMEOrder orders = 1;
 }
 

proto/metacrypt/v1/engine.proto

@@ -10,7 +10,7 @@ service EngineService {
   rpc Mount(MountRequest) returns (MountResponse);
   rpc Unmount(UnmountRequest) returns (UnmountResponse);
   rpc ListMounts(ListMountsRequest) returns (ListMountsResponse);
-  rpc Request(EngineRequest) returns (EngineResponse);
+  rpc Execute(ExecuteRequest) returns (ExecuteResponse);
 }
 
 message MountRequest {
@@ -36,13 +36,13 @@ message MountInfo {
   string mount_path = 3;
 }
 
-message EngineRequest {
+message ExecuteRequest {
   string mount = 1;
   string operation = 2;
   string path = 3;
   google.protobuf.Struct data = 4;
 }
 
-message EngineResponse {
+message ExecuteResponse {
   google.protobuf.Struct data = 1;
 }

proto/metacrypt/v1/policy.proto

@@ -5,9 +5,9 @@ package metacrypt.v1;
 option go_package = "git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1;metacryptv1";
 
 service PolicyService {
-  rpc CreatePolicy(CreatePolicyRequest) returns (PolicyRule);
+  rpc CreatePolicy(CreatePolicyRequest) returns (CreatePolicyResponse);
   rpc ListPolicies(ListPoliciesRequest) returns (ListPoliciesResponse);
-  rpc GetPolicy(GetPolicyRequest) returns (PolicyRule);
+  rpc GetPolicy(GetPolicyRequest) returns (GetPolicyResponse);
   rpc DeletePolicy(DeletePolicyRequest) returns (DeletePolicyResponse);
 }
 
@@ -25,6 +25,14 @@ message CreatePolicyRequest {
   PolicyRule rule = 1;
 }
 
+message CreatePolicyResponse {
+  PolicyRule rule = 1;
+}
+
+message GetPolicyResponse {
+  PolicyRule rule = 1;
+}
+
 message ListPoliciesRequest {}
 message ListPoliciesResponse {
   repeated PolicyRule rules = 1;