Single-source the version from package.json (closes #5)

src/index.ts imports package.json for VERSION and bin/quak.ts passes
VERSION to commander, so package.json is the only place the version is
written. tsc copies package.json to dist/package.json, so the import
resolves from the built output; script/build runs the built CLI with
--version to prove it. A test checks VERSION and quak --version against
package.json.

Model: opus-5-5

bin/quak.ts

@@ -19,6 +19,7 @@ import {
     fixMissingThumbnailsCommand,
 } from "../src/cli-commands.js";
 import { loadSession } from "../src/cli-session.js";
+import { VERSION } from "../src/index.js";
 
 const paths = envPaths("quak", { suffix: "" });
 
@@ -27,7 +28,7 @@ const program = new Command();
 program
     .name("quak")
     .description("CLI for the Ente end-to-end encrypted photo service")
-    .version("0.0.0")
+    .version(VERSION)
     .option(
         "--cache-dir <path>",
         "Directory for the local metadata/content cache " +