v0.3.0: fix HTTP client leak, add tests and CI pipeline

Reuse a single long-poll HTTP client instead of creating one per
Events() call (~every 30s). Make TLS skip-verify configurable via
syncthing_insecure_tls. Log previously swallowed config errors.
Add unit tests for all monitor trackers, config, and state logic.
Add CI workflow (vet, golangci-lint, govulncheck, go test -race).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/monitor/recent_test.go

@@ -0,0 +1,44 @@
+package monitor
+
+import "testing"
+
+func TestRecentTracker_AddOrder(t *testing.T) {
+	rt := NewRecentTracker()
+	rt.Add("a.txt", "docs")
+	rt.Add("b.txt", "docs")
+
+	files := rt.Files()
+	if len(files) != 2 {
+		t.Fatalf("expected 2 files, got %d", len(files))
+	}
+	if files[0].Name != "b.txt" {
+		t.Errorf("most recent should be first, got %s", files[0].Name)
+	}
+	if files[1].Name != "a.txt" {
+		t.Errorf("oldest should be last, got %s", files[1].Name)
+	}
+}
+
+func TestRecentTracker_RingBufferOverflow(t *testing.T) {
+	rt := NewRecentTracker()
+	for i := 0; i < 15; i++ {
+		rt.Add("file", "f")
+	}
+	files := rt.Files()
+	if len(files) != maxRecentFiles {
+		t.Errorf("expected %d files after overflow, got %d", maxRecentFiles, len(files))
+	}
+}
+
+func TestRecentTracker_FilesCopy(t *testing.T) {
+	rt := NewRecentTracker()
+	rt.Add("a.txt", "docs")
+
+	files := rt.Files()
+	files[0].Name = "mutated"
+
+	original := rt.Files()
+	if original[0].Name != "a.txt" {
+		t.Error("Files() should return a copy, but internal state was mutated")
+	}
+}