Move internal domain packages to pkg/ for public import

[polymorcodeus]

Summary

Adds the public pkg/ tree by moving internal/book, internal/catalog, and internal/web to pkg/book,
pkg/catalog, and pkg/web, with repo-wide import rewrites. Phase 1 of the importable-library workstream, following
the in-place decouple and ahead of the public API polish.

What's new

• Public packages - pkg/book (domain types and pure logic), pkg/catalog (TOML storage, schema migration,
  SQLite index), and pkg/web (title fetch, URL open) are importable by external modules.
• Pure movement - 17 git mv renames plus 44 one-line import swaps across 18 files; zero logic edits.
• Import boundary - no pkg/ package imports bubbletea, huh, lipgloss, urfave, or internal/*.

Behavior changes / guardrails

• CLI behavior is unchanged; every changed Go line is an import path, so the diff reviews as pure movement.
• internal/theme and internal/model stay internal; cmd keeps owning flag layering, spinners, and styled errors.
• The pkg/ API follows module semver but may break on minor releases until the tool cuts v2.0.0.

Testing

• go list -deps ./pkg/... is free of TUI and CLI framework imports.
• Smoke matrix against a temp config: shelf/collection/mark add, list, get, search, index rebuild, catalog config,
  trash, restore, doctor, gc.
• make check runs fmt, vet, lint, and tests; all green.