Polish pkg/ public API with catalog.Paths and a dependency guard

[polymorcodeus]

Summary

Adds the Phase 2 public-API polish for the pkg/ library: narrowed storage signatures via catalog.Paths, a package doc pass with export pruning, and a dependency guard that locks the TUI/CLI decoupling in. Completes the pkg/ extraction workstream; the API stays provisional until the tool cuts v2.0.0.

What's new

• catalog.Paths - LoadShelves, OpenIndex, IndexPath, and the Index methods Sync/Rebuild/StaleFiles now take Paths{ShelfRoot, CatalogFormat, ConfigFile} instead of the full *book.Config, keeping CLI-behavior fields out of the storage contract. catalog.PathsFromConfig bridges at the cmd boundary.
• catalog.ShelfPath - shelf path computation moves off Shelf (AddFileDetail deleted) into a free function, so pkg/book carries no path policy.
• Doc pass - real package comments on pkg/book, pkg/catalog, and pkg/web; IntPtr removed in favor of Go 1.26 new(expr); DedupUnique unexported (only MergeTags used it); new pkg/book/example_test.go runs an open/add/save round trip as an external consumer.
• Dependency guard - make check-deps asserts go list -deps ./pkg/... stays free of bubbletea/huh/lipgloss, urfave/*, and internal/*; wired into make check and CI.
• Docs - README gains a "Use as a Library" section (import paths, minimal example, provisional-API notice, pure-Go sqlite note); and CONTRIBUTING.md are brought up to the pkg/ layout and import rules.

Behavior changes / guardrails

• CLI behavior is byte-for-byte unchanged; every change is signature-level, test-helper-level, or docs.
• An empty Paths.ConfigFile disables the defensive config-file exclusion from shelf globs; previously a zero-value exclusion could never fire.
• pkg/catalog pulls in modernc.org/sqlite transitively (pure Go, no cgo); depending on pkg/book alone avoids the driver.
• pkg/web - Windows open now uses rundll32 url.dll,FileProtocolHandler, removing the cmd /c start
&/% injection vector.

Testing

• Existing suites pass with only call-site retypes to Paths; no assertion changes.
• The round-trip example runs under go test, proving an external module can load, mutate, and save shelves.
• The guard is verified in both directions: the real graph is clean, and a matching pattern on a real dependency trips it.
• Smoke matrix against an isolated config home: shelf/collection/mark add, list, get/edit/remove/restore, index rebuild/sync, mark search, doctor, catalog config.
• make check runs fmt, vet, lint, and tests; all green.