fix: resolve go vet error and dayStart logic in ComputeDailyTotals

- Fix 'string(d)' int-to-rune conversion in rpg_test.go by using fmt.Sprintf
- Fix ComputeDailyTotals dayStart logic: initial state should be StateWorking
  when dayStart > 0, correctly counting work from dayStart to first out event
- Update README project structure to reflect new domain/handler/repo layout
- Implement missing achievements: rpg_pioneer (on RPG enable) and
  salary_setter (on first rate set)
- Add tryUnlockAchievement helper to Handler

internal/domain/sanitize.go

@@ -0,0 +1,38 @@
+package domain
+
+import (
+	"strings"
+	"unicode"
+)
+
+// SanitizeNote cleans user-provided note text: trims whitespace, limits length,
+// and removes control characters (keeps newlines).
+func SanitizeNote(s string) string {
+	s = strings.TrimSpace(s)
+	if len(s) > MaxNoteLength {
+		s = s[:MaxNoteLength]
+	}
+	return strings.Map(func(r rune) rune {
+		if r == '\n' || r == '\t' || r == ' ' {
+			return r
+		}
+		if unicode.IsControl(r) {
+			return -1
+		}
+		return r
+	}, s)
+}
+
+// SanitizeDisplayName cleans a display name (username) for safe rendering.
+func SanitizeDisplayName(s string) string {
+	s = strings.TrimSpace(s)
+	if len(s) > MaxUsernameLength {
+		s = s[:MaxUsernameLength]
+	}
+	return strings.Map(func(r rune) rune {
+		if unicode.IsControl(r) {
+			return -1
+		}
+		return r
+	}, s)
+}