Review Makefile targets as candidates for gonext CLI commands

`templates/Makefile` has grown to 24 targets. Some of them are really capabilities of the tool rather than of the generated project, and a few already have a CLI counterpart (`run` wraps `gonext dev`, `migrate-up` wraps `gonext migrate`). Review each target against the placement rule in `CLAUDE.md` — *scaffoldable* (stays a Make target the project owns) vs *CLI-native* (a `gonext` subcommand the project invokes but does not vendor) — and decide which should move.

Current targets:

`run build test vet generate generate-check openapi openapi-check lint vulncheck secrets-scan tidy db-up db-down migrate-up smoke frontend-dev frontend-build frontend-test frontend-lint frontend-typecheck frontend-audit hooks-install`

Candidates worth a closer look:

- **`openapi` / `openapi-check`** — orchestrates a Go run *and* a pnpm codegen step; the shape of that pipeline is gonext's, not the project's (`gonext openapi`?).
- **`test` / `smoke`** — both embed Docker Compose orchestration (bring up Postgres, wait for `pg_isready`, migrate, run, tear down) with a `trap`. That logic is copied verbatim into every project and is the kind of thing `gonext dev` already absorbed for the run loop.
- **`generate` / `generate-check`** — thin `wire` wrappers; `roadmap.md` already lists a wire-refresh generator under *add & dev-loop generators*.
- **`db-up` / `db-down`** — trivial today, but a `gonext db` family would be the natural home if the compose orchestration above moves.

Things that probably stay as Make targets: `build`, `vet`, `lint`, `vulncheck`, `tidy`, the `frontend-*` passthroughs, `hooks-install` — one-line tool invocations a project owner would expect to edit.

Outcome: a short decision per target, and follow-up issues for any that become subcommands. Not a commitment to move anything; the point is to stop the Makefile growing orchestration that every generated project then carries frozen at scaffold time.

Read the placement rule in CLAUDE.md, then inspect templates/Makefile target by target, including the Docker Compose orchestration and existing gonext commands. Check roadmap.md for the planned wire-refresh generator. Done means a short decision for all 24 targets and follow-up issues for any proposed CLI subcommands.

Written by the indexing model from the issue text.