init: added the base files by ai and debugged by hand

it's great but currently it has a basic error which is go nil pointer dereference

WIP

load_whitelist.go

@@ -0,0 +1,51 @@
+// load_whitelist.go — helper to load the permanent whitelist at startup.
+//
+// This file is separate from watcher.go because the startup-time load
+// is a one-time operation (no polling needed).
+//
+// We also handle the case where the file doesn't exist (create an empty
+// one) so the service can start even if the file hasn't been mounted yet.
+//
+// Why create the file if it doesn't exist?
+//
+// - The watcher will fail to stat a non-existent file, but the service
+//   should start anyway. An empty whitelist file is a safe default.
+
+package main
+
+import (
+	"bufio"
+	"log"
+	"os"
+)
+
+// loadPermanentWhitelist reads the permanent whitelist file and populates
+// the in-memory store.
+//
+// If the file doesn't exist, we create an empty one so the watcher can
+// pick it up on the next poll.
+func loadPermanentWhitelist(path string) {
+	entries := make(map[string]struct{})
+
+	f, err := os.Open(path)
+	if err != nil {
+		// File doesn't exist — create an empty one.
+		log.Printf("whitelist file %s not found, creating empty file", path)
+		if err := os.WriteFile(path, []byte("# Empty whitelist\n"), 0644); err != nil {
+			log.Fatalf("failed to create whitelist file: %v", err)
+		}
+		return
+	}
+	defer f.Close()
+
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		line := scanner.Text()
+		if line == "" || line[0] == '#' {
+			continue
+		}
+		entries[line] = struct{}{}
+	}
+
+	log.Printf("loaded %d entries from %s", len(entries), path)
+}