ci: add static analysis, sanitizers, and formatting enforcement

Add Tier 1 review automation to catch issues before human review:

- Add cppcheck and clang-format to CI lint job
- Add sanitizer matrix (ASan + TSan) CI job
- Enable -Wextra -Wpedantic -Werror in CI build
- Add SANITIZER and STRICT_WARNINGS CMake options
- Add .clang-format for consistent code style
- Update Dockerfile with cppcheck and clang-format
- Fix sign-compare and unused-parameter warnings for -Werror

src/shared/file.c

@@ -235,7 +235,7 @@ bool file_send_sendfile(File *file, int file_descriptor, bool use_metadata, bool
   }
 
   off_t offset = 0;
-  while (offset < file_size) {
+  while ((unsigned long long)offset < file_size) {
     ssize_t sent = sendfile(file_descriptor, fd, &offset, file_size - offset);
     if (sent == -1) {
       perror("sendfile failed");