fix(lint): clear the two findings left by #69 and #70 (#72)

- observation_update_test.go (#69) lacked the fts5 build tag its helper
  (testObservationStore, in observation_store_test.go) has, so `go vet ./...`
  without tags failed with "undefined: testObservationStore".
- Client.knn (#70) concatenates its WHERE clause into the query. The clause is
  built only from constant text with "?" placeholders (see nearest) and every
  value goes through args, so gosec's G202 is a false positive; annotate it the
  way the file already annotates G201.

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

internal/db/gorm/observation_update_test.go

@@ -1,3 +1,5 @@
+//go:build fts5
+
 package gorm
 
 import (

internal/vector/sqlitevec/client.go

@@ -526,6 +526,7 @@ func (c *Client) nearest(ctx context.Context, queryBlob []byte, docType, project
 
 // knn runs one vec0 nearest-neighbour query. where holds the MATCH and filters vec0 can answer on their own.
 func (c *Client) knn(ctx context.Context, where string, args []any, limit int) ([]QueryResult, error) {
+	// #nosec G202 -- where is built from constant clauses with "?" placeholders only (see nearest); every value goes via args
 	rows, err := c.db.QueryContext(ctx,
 		"SELECT doc_id, distance, sqlite_id, doc_type, field_type, project, scope FROM vectors"+where+" ORDER BY distance LIMIT ?",
 		append(append([]any{}, args...), limit)...)