v0.3.0: fix HTTP client leak, add tests and CI pipeline

Reuse a single long-poll HTTP client instead of creating one per
Events() call (~every 30s). Make TLS skip-verify configurable via
syncthing_insecure_tls. Log previously swallowed config errors.
Add unit tests for all monitor trackers, config, and state logic.
Add CI workflow (vet, golangci-lint, govulncheck, go test -race).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/monitor/speed_test.go

@@ -0,0 +1,60 @@
+package monitor
+
+import (
+	"testing"
+	"time"
+)
+
+func TestSpeedTracker_FirstUpdateBaseline(t *testing.T) {
+	s := NewSpeedTracker()
+	s.Update(1000, 500)
+
+	down, up := s.Rates()
+	if down != 0 || up != 0 {
+		t.Errorf("first update should be baseline (0,0), got (%f,%f)", down, up)
+	}
+}
+
+func TestSpeedTracker_RateCalculation(t *testing.T) {
+	s := NewSpeedTracker()
+
+	// Seed baseline
+	s.mu.Lock()
+	s.lastIn = 0
+	s.lastOut = 0
+	s.lastTime = time.Now().Add(-1 * time.Second)
+	s.mu.Unlock()
+
+	s.Update(1000, 500)
+
+	down, up := s.Rates()
+	// Allow some tolerance for timing
+	if down < 900 || down > 1100 {
+		t.Errorf("expected ~1000 B/s down, got %f", down)
+	}
+	if up < 400 || up > 600 {
+		t.Errorf("expected ~500 B/s up, got %f", up)
+	}
+}
+
+func TestSpeedTracker_NegativeDeltaClamped(t *testing.T) {
+	s := NewSpeedTracker()
+
+	// Seed with high values
+	s.mu.Lock()
+	s.lastIn = 5000
+	s.lastOut = 3000
+	s.lastTime = time.Now().Add(-1 * time.Second)
+	s.mu.Unlock()
+
+	// Update with lower values (counter reset)
+	s.Update(100, 50)
+
+	down, up := s.Rates()
+	if down < 0 {
+		t.Errorf("negative download rate not clamped: %f", down)
+	}
+	if up < 0 {
+		t.Errorf("negative upload rate not clamped: %f", up)
+	}
+}