Replace sharp with jpeg-js + exif-reader; add bun compile binary

sharp was the only native dependency preventing a single-file binary.
Replaced with:
  - jpeg-js (pure JS) for JPEG decode/resize/encode in thumbnail gen
  - exif-reader (pure JS) for EXIF tag parsing
  - Raw JPEG APP1 marker extraction for EXIF segment discovery
  - Raw XMP packet extraction from file bytes

make build-bin produces a ~59MB self-contained Mach-O binary via
bun build --compile (bun installed via nix-shell). Zero runtime
dependencies. Tested: login, whoami, collections, files all work
from the compiled binary.

bin/quak.ts: init() called once at program start before commander
parses, so libsodium is ready for all commands including those that
restore sessions from disk.

118 tests pass.

test/cli/metadata-backup.test.ts

@@ -42,7 +42,7 @@ import {
     deriveLoginSubkey,
     encryptBlob,
 } from "../../src/crypto/index.js";
-import sharp from "sharp";
+import * as jpegJs from "jpeg-js";
 import { Client } from "../../src/client.js";
 import { runMetadataBackup } from "../../src/metadata-backup.js";
 import type { KeyAttributes } from "../../src/auth/types.js";
@@ -290,11 +290,19 @@ const buildMetaMock = async (): Promise<MetaMockState> => {
     );
 
     // Generate a real JPEG for EXIF extraction tests
-    const tinyJpeg = await sharp({
-        create: { width: 100, height: 80, channels: 3, background: "red" },
-    })
-        .jpeg({ quality: 80 })
-        .toBuffer();
+    const jw = 100;
+    const jh = 80;
+    const jpixels = new Uint8Array(jw * jh * 4);
+    for (let i = 0; i < jpixels.length; i += 4) {
+        jpixels[i] = 255;
+        jpixels[i + 1] = 0;
+        jpixels[i + 2] = 0;
+        jpixels[i + 3] = 255;
+    }
+    const tinyJpeg = jpegJs.encode(
+        { data: jpixels, width: jw, height: jh },
+        80,
+    ).data;
     const filePush1 =
         sodium.crypto_secretstream_xchacha20poly1305_init_push(fk1);
     const encFileBody1 = sodium.crypto_secretstream_xchacha20poly1305_push(
@@ -606,11 +614,10 @@ describe("quak backup-metadata", () => {
             ),
         );
 
-        // imageMetadata from sharp should be present
+        // imageMetadata from JPEG parsing should be present
         expect(fileMeta.imageMetadata).toBeDefined();
         expect(fileMeta.imageMetadata.format).toBe("jpeg");
         expect(fileMeta.imageMetadata.width).toBe(100);
         expect(fileMeta.imageMetadata.height).toBe(80);
-        expect(fileMeta.imageMetadata.channels).toBe(3);
     });
 });