chore: reconcile on-client path + add golangci-lint config (R13+R14)

R13 — on-client path reconciliation:
- AGENTS.md: 6 occurrences of /opt/homelab-context/ → /opt/homelab/
  (sections 1, 2, 5, 7)
- .agents/NOMOS.md: 2 occurrences of /opt/homelab-context/ → /opt/homelab/
- CLIENTS.md already used /opt/homelab/ — now consistent across all docs.
  The repo is still named 'homelab-context' (git remote), it just clones
  to /opt/homelab/ on enrolled clients per CLIENTS.md.

R14 — golangci-lint/staticcheck/govulncheck tooling:
- .golangci.yml (new): config enabling govet, staticcheck, ineffassign,
  unused, errcheck, gosimple, typecheck, misspell, revive. Excludes
  generated code (internal/httpapi/gen/, internal/db/sqlcgen/) and
  relaxes errcheck in test files.
- Makefile: split 'lint' target into vet, golangci, govulncheck subtargets.
  Each checks if the tool is installed and prints install instructions
  if not. 'make lint' runs all three.
- CI already had golangci-lint-action + govulncheck (both advisory);
  the action auto-discovers .golangci.yml.

Makefile

@@ -20,9 +20,18 @@ test-db:
 	OIKOS_TEST_DATABASE_URL="postgres://oikos:$${OIKOS_DB_PASSWORD:-oikos_dev}@localhost:5432/oikos?sslmode=disable" \
 		$(GO) test -race -count=1 ./internal/db/ ./internal/httpapi/ ./internal/mcp/
 
-lint:
+lint: vet golangci govulncheck
+
+vet:
 	$(GO) vet ./...
-	@command -v golangci-lint >/dev/null 2>&1 && golangci-lint run || echo "golangci-lint not installed, skipping"
+
+golangci:
+	@command -v golangci-lint >/dev/null 2>&1 && golangci-lint run --config .golangci.yml || echo "golangci-lint not installed — see https://golangci-lint.run/usage/install/"
+
+govulncheck:
+	@command -v govulncheck >/dev/null 2>&1 && govulncheck ./... || echo "govulncheck not installed — run: go install golang.org/x/vuln/cmd/govulncheck@latest"
+
+.PHONY: lint vet golangci govulncheck
 
 generate:
 	$(GO) run github.com/oapi-codegen/oapi-codegen/v2/cmd/oapi-codegen@v2.4.1 \