fix(01-01): replace INSERT OR REPLACE with UPSERT and enable FK enforcement

- Add PRAGMA foreign_keys = ON in InitDB() after SetMaxOpenConns(1)
- Replace INSERT OR REPLACE INTO updates with named-column INSERT ON CONFLICT UPSERT
- UPSERT preserves tag_assignments rows on re-insert (fixes DATA-01)
- FK enforcement makes ON DELETE CASCADE fire on tag deletion (fixes DATA-02)

pkg/diunwebhook/diunwebhook.go

@@ -62,6 +62,9 @@ func InitDB(path string) error {
 		return err
 	}
 	db.SetMaxOpenConns(1)
+	if _, err = db.Exec(`PRAGMA foreign_keys = ON`); err != nil {
+		return err
+	}
 	_, err = db.Exec(`CREATE TABLE IF NOT EXISTS updates (
 		image           TEXT PRIMARY KEY,
 		diun_version    TEXT NOT NULL DEFAULT '',
@@ -106,7 +109,29 @@ func InitDB(path string) error {
 func UpdateEvent(event DiunEvent) error {
 	mu.Lock()
 	defer mu.Unlock()
-	_, err := db.Exec(`INSERT OR REPLACE INTO updates VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,NULL)`,
+	_, err := db.Exec(`
+		INSERT INTO updates (
+			image, diun_version, hostname, status, provider,
+			hub_link, mime_type, digest, created, platform,
+			ctn_name, ctn_id, ctn_state, ctn_status,
+			received_at, acknowledged_at
+		) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,NULL)
+		ON CONFLICT(image) DO UPDATE SET
+			diun_version    = excluded.diun_version,
+			hostname        = excluded.hostname,
+			status          = excluded.status,
+			provider        = excluded.provider,
+			hub_link        = excluded.hub_link,
+			mime_type       = excluded.mime_type,
+			digest          = excluded.digest,
+			created         = excluded.created,
+			platform        = excluded.platform,
+			ctn_name        = excluded.ctn_name,
+			ctn_id          = excluded.ctn_id,
+			ctn_state       = excluded.ctn_state,
+			ctn_status      = excluded.ctn_status,
+			received_at     = excluded.received_at,
+			acknowledged_at = NULL`,
 		event.Image, event.DiunVersion, event.Hostname, event.Status, event.Provider,
 		event.HubLink, event.MimeType, event.Digest,
 		event.Created.Format(time.RFC3339), event.Platform,