fix: address code review findings for Phase 7-8

Bugs fixed:
- Renderer.Error set WriteHeader before Content-Type, causing
  the header to be silently dropped. Now sets Content-Type first.
- truncate template function operated on bytes, not runes — could
  split multi-byte UTF-8 characters (Norwegian æøå). Now uses
  []rune for correct Unicode handling.

Performance:
- Skip session DB lookup (2 queries) on /static/ and /uploads/
  requests — these never use user context.

UX consistency:
- Replace all http.NotFound and http.Error("Forbidden") in
  handler layer with styled error pages via Renderer.Error.
- Add notFound/forbidden helper methods on Handler.

Deployment fixes:
- Remove false libc6/glibc deps from nfpm.yaml (binary is
  statically linked with CGO_ENABLED=0).
- Add CGO_ENABLED=0 to Makefile build target for consistency.
- Add .dockerignore to exclude .git, dist/, data/ from build
  context.
- Remove phantom 'lint' from Makefile .PHONY.
- Document ProtectSystem=strict constraint in systemd service.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Makefile

@@ -7,11 +7,11 @@ LDFLAGS    := -s -w -X main.version=$(VERSION) -X main.buildDate=$(BUILD_DATE)
 PLATFORMS  := linux/amd64 linux/arm64
 DIST       := dist
 
-.PHONY: build build-all deb rpm container artifacts checksums clean test lint
+.PHONY: build build-all deb rpm container tarballs artifacts checksums clean test
 
 ## Build for current platform
 build:
-	go build -ldflags="$(LDFLAGS)" -o favoritter ./cmd/favoritter
+	CGO_ENABLED=0 go build -ldflags="$(LDFLAGS)" -o favoritter ./cmd/favoritter
 
 ## Run tests
 test: