feat: Go rewrite M1 — skeleton, tooling, and hello server

Stand up the Go project alongside the Python backend so both run
independently during migration. `make web-go` builds and serves on :8080;
`make web-py` (alias: `make web`) keeps the Python side on :5001.

- go/: new module `fuj-management/go` (Go 1.26)
  - cmd/fuj: stdlib-flag dispatcher; `server` + `version` work,
    fees/reconcile/sync/infer stubbed for M2/M4
  - internal/config: env loader mirroring scripts/config.py
  - internal/logging: slog setup, level taken from config
  - internal/web: net/http ServeMux + request-timer middleware
  - build/Dockerfile: golang:1.26 → alpine:3 multi-stage image
  - .golangci.yml: govet, staticcheck, errcheck, gofumpt, unused
- Makefile: web→web-py alias; go-build/go-test/go-run/go-lint/web-go
- CI: parallel build-go job in .gitea/workflows/build.yaml (<tag>-go image)
- docs/plans/: M1 kickoff plan + progress tracker (M1 complete)
- .claude/settings.json: gofumpt + golangci-lint permissions

Gate: make go-build ✓  make go-lint ✓  make go-test ✓  curl :8080 ✓

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

go/internal/config/config.go

@@ -0,0 +1,56 @@
+package config
+
+import (
+	"os"
+	"strconv"
+	"time"
+)
+
+// Google Sheets IDs — change in code if sheets change (not from env).
+const (
+	AttendanceSheetID = "1E2e_gT_K5AwSRCDLDTa2UetZTkHmBOcz0kFbBUNUNBA"
+	PaymentsSheetID   = "1Om0YPoDVCH5cV8BrNz5LG5eR5MMU05ypQC7UMN1xn_Y"
+	JuniorSheetGID    = "1213318614"
+)
+
+// Config holds all runtime configuration loaded from environment variables.
+// Mirrors scripts/config.py.
+type Config struct {
+	CredentialsPath  string
+	BankAccount      string
+	CacheTTL         time.Duration
+	CacheAPICheckTTL time.Duration
+	LogLevel         string
+	FioAPIToken      string
+	ServerAddr       string
+}
+
+// Load reads configuration from the environment, applying defaults that
+// match the Python side.
+func Load() Config {
+	return Config{
+		CredentialsPath:  env("CREDENTIALS_PATH", ".secret/fuj-management-bot-credentials.json"),
+		BankAccount:      env("BANK_ACCOUNT", "CZ8520100000002800359168"),
+		CacheTTL:         envDuration("CACHE_TTL_SECONDS", 300),
+		CacheAPICheckTTL: envDuration("CACHE_API_CHECK_TTL_SECONDS", 300),
+		LogLevel:         env("LOG_LEVEL", "INFO"),
+		FioAPIToken:      env("FIO_API_TOKEN", ""),
+		ServerAddr:       env("SERVER_ADDR", ":8080"),
+	}
+}
+
+func env(key, fallback string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return fallback
+}
+
+func envDuration(key string, defaultSeconds int) time.Duration {
+	if v := os.Getenv(key); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			return time.Duration(n) * time.Second
+		}
+	}
+	return time.Duration(defaultSeconds) * time.Second
+}

go/internal/logging/logger.go

@@ -0,0 +1,24 @@
+package logging
+
+import (
+	"log/slog"
+	"os"
+	"strings"
+)
+
+// New returns a slog.Logger at the given level (DEBUG|INFO|WARN|ERROR).
+// Pass config.Config.LogLevel as the argument. Defaults to INFO on unrecognised input.
+func New(level string) *slog.Logger {
+	var l slog.Level
+	switch strings.ToUpper(level) {
+	case "DEBUG":
+		l = slog.LevelDebug
+	case "WARN", "WARNING":
+		l = slog.LevelWarn
+	case "ERROR":
+		l = slog.LevelError
+	default:
+		l = slog.LevelInfo
+	}
+	return slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: l}))
+}

go/internal/web/middleware/timer.go

@@ -0,0 +1,34 @@
+package middleware
+
+import (
+	"log/slog"
+	"net/http"
+	"time"
+)
+
+type statusWriter struct {
+	http.ResponseWriter
+	status int
+}
+
+func (sw *statusWriter) WriteHeader(code int) {
+	sw.status = code
+	sw.ResponseWriter.WriteHeader(code)
+}
+
+// RequestTimer logs method, path, status, and elapsed milliseconds for every
+// request. Parity with Python's get_render_time — the elapsed value maps to
+// render_time.total in the M5 JSON allowlist.
+func RequestTimer(logger *slog.Logger, next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		start := time.Now()
+		sw := &statusWriter{ResponseWriter: w, status: http.StatusOK}
+		next.ServeHTTP(sw, r)
+		logger.Info("req",
+			"method", r.Method,
+			"path", r.URL.Path,
+			"status", sw.status,
+			"ms", time.Since(start).Milliseconds(),
+		)
+	})
+}

go/internal/web/server.go

@@ -0,0 +1,32 @@
+package web
+
+import (
+	"fmt"
+	"fuj-management/go/internal/web/middleware"
+	"log/slog"
+	"net/http"
+)
+
+// BuildInfo carries the linker-injected build metadata.
+type BuildInfo struct {
+	Version   string
+	Commit    string
+	BuildDate string
+}
+
+// Run registers routes and starts the HTTP server on addr.
+func Run(logger *slog.Logger, addr string, build BuildInfo) error {
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /{$}", helloHandler(build))
+
+	logger.Info("starting server", "addr", addr)
+	return http.ListenAndServe(addr, middleware.RequestTimer(logger, mux))
+}
+
+func helloHandler(build BuildInfo) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		fmt.Fprintf(w, "fuj-go ok\nversion: %s\ncommit:  %s\nbuilt:   %s\n",
+			build.Version, build.Commit, build.BuildDate)
+	}
+}