diff --git a/.cursor/rules/engineering.mdc b/.cursor/rules/engineering.mdc
index c797580..3c6d469 100644
--- a/.cursor/rules/engineering.mdc
+++ b/.cursor/rules/engineering.mdc
@@ -234,7 +234,7 @@ npx @redocly/cli lint docs/openapi.yaml
 # birdfmt: go test ./internal/birdfmt/... -count=1
 ```
 
-**Рекомендуется (не внедрено):** CI job `web`; `.golangci.yml`; pre-commit gofmt/prettier.
+**Рекомендуется (частично внедрено):** CI job `web` (Gitea); `scripts/lint-httpapi.sh` в job `go`; `.golangci.yml` (локально); pre-commit gofmt/prettier.
 
 **Только code review:** слои SQL; роли; idempotency; OpenAPI bodies; secrets в compose.
 
diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 953b09c..7e3ddcd 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -121,6 +121,26 @@ jobs:
       - name: Lint OpenAPI (Redocly)
         run: npx --yes @redocly/cli@1 lint docs/openapi.yaml
 
+  # ---------------------------------------------------------------------------
+  web:
+    needs: [changes]
+    if: needs.changes.outputs.web == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+      - name: npm ci, check, lint
+        run: |
+          set -euxo pipefail
+          cd web
+          npm ci
+          npm run check
+          npm run lint
+
   # ---------------------------------------------------------------------------
   go:
     needs: [changes]
@@ -135,6 +155,8 @@ jobs:
           cache-dependency-path: go.sum
       - name: Vet
         run: go vet ./...
+      - name: Lint httpapi (ERR-01 / ARCH-01)
+        run: sh scripts/lint-httpapi.sh
       - name: Test
         run: go test ./... -race -count=1
       - name: Build all commands
diff --git a/.golangci.yml b/.golangci.yml
new file mode 100644
index 0000000..dd3d234
--- /dev/null
+++ b/.golangci.yml
@@ -0,0 +1,17 @@
+run:
+  timeout: 5m
+
+linters:
+  enable:
+    - gofmt
+    - govet
+    - errcheck
+
+issues:
+  exclude-use-default: false
+  max-issues-per-linter: 50
+  max-same-issues: 20
+
+linters-settings:
+  gofmt:
+    simplify: true
diff --git a/scripts/lint-httpapi.sh b/scripts/lint-httpapi.sh
new file mode 100644
index 0000000..2ddcef9
--- /dev/null
+++ b/scripts/lint-httpapi.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env sh
+# Engineering gates for internal/httpapi (ERR-01, ARCH-01).
+set -eu
+
+ROOT="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+
+HTTPAPI="internal/httpapi"
+FAIL=0
+
+echo "==> ERR-01: no err.Error() in 5xx problem details"
+if grep -rE 'writeProblem\(w, http\.StatusInternalServerError.*err\.Error\(\)' "$HTTPAPI" 2>/dev/null; then
+  FAIL=1
+fi
+if grep -rE 'writeProblem\(w, http\.StatusBadGateway.*err\.Error\(\)' "$HTTPAPI" 2>/dev/null; then
+  FAIL=1
+fi
+
+echo "==> ARCH-01: no SQL/pgx queries in httpapi"
+if grep -rE 'pool\.(Query|Exec|QueryRow)|SELECT |INSERT INTO |UPDATE .* SET |DELETE FROM ' "$HTTPAPI" 2>/dev/null; then
+  FAIL=1
+fi
+
+if [ "$FAIL" -ne 0 ]; then
+  echo "lint-httpapi: failed" >&2
+  exit 1
+fi
+echo "lint-httpapi: ok"