Initial commit: notifications, monitoring, on-call and incidents

One binary and one SQLite file. Topics with ntfy-style publish and
subscribe, HTTP/TCP/DNS/TLS/heartbeat monitors with a public status page,
schedules and escalation policies, and incidents with a timeline and
post-mortem. The UI follows the Lightwell design language.

Builds against an unreleased Reef (secretbox) through a local replace line.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,28 @@
+# syntax=docker/dockerfile:1
+# Packages a binary that was already built for each architecture, so the arm64 image needs
+# no emulation. Build the binaries, then the image:
+#
+#   for a in amd64 arm64; do
+#     mkdir -p dist/bin/linux_$a
+#     CGO_ENABLED=0 GOOS=linux GOARCH=$a go build -trimpath -ldflags "-s -w" -o dist/bin/linux_$a/sandbar ./cmd/sandbar
+#   done
+#   docker buildx build --platform linux/amd64,linux/arm64 -t sandbar .
+FROM --platform=$BUILDPLATFORM alpine:3.22 AS prep
+RUN apk add --no-cache ca-certificates \
+ && mkdir /data && chown 65532:65532 /data
+
+FROM scratch
+ARG TARGETARCH
+LABEL org.opencontainers.image.title="Sandbar" \
+      org.opencontainers.image.description="Notifications, monitoring, on-call and incident response" \
+      org.opencontainers.image.source="https://git.veillax.com/Veillax/sandbar" \
+      org.opencontainers.image.licenses="AGPL-3.0-only"
+COPY --from=prep /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=prep --chown=65532:65532 /data /data
+COPY dist/bin/linux_${TARGETARCH}/sandbar /sandbar
+USER 65532:65532
+ENV SANDBAR_DATA=/data
+VOLUME ["/data"]
+EXPOSE 8090
+ENTRYPOINT ["/sandbar"]
+CMD ["-listen", ":8090"]