Replace sharp with jpeg-js + exif-reader; add bun compile binary

sharp was the only native dependency preventing a single-file binary.
Replaced with:
  - jpeg-js (pure JS) for JPEG decode/resize/encode in thumbnail gen
  - exif-reader (pure JS) for EXIF tag parsing
  - Raw JPEG APP1 marker extraction for EXIF segment discovery
  - Raw XMP packet extraction from file bytes

make build-bin produces a ~59MB self-contained Mach-O binary via
bun build --compile (bun installed via nix-shell). Zero runtime
dependencies. Tested: login, whoami, collections, files all work
from the compiled binary.

bin/quak.ts: init() called once at program start before commander
parses, so libsodium is ready for all commands including those that
restore sessions from disk.

118 tests pass.

Makefile

@@ -1,4 +1,4 @@
-.PHONY: test lint fmt fmt-check check build dev clean docker hooks
+.PHONY: test lint fmt fmt-check check build build-bin dev clean docker hooks
 
 # Use `timeout` (GNU coreutils) when available so `make test` is hard-capped.
 # On macOS without coreutils this is empty and the cap is skipped.
@@ -26,6 +26,9 @@ check: test lint fmt-check
 build:
 	@$(YARN) tsc
 
+build-bin:
+	nix-shell -p bun --run "bun build bin/quak.ts --compile --outfile bin/quak"
+
 dev:
 	@$(YARN) tsc --watch