Mark the package private and declare engines and exports (closes #6)

quak is not published, so package.json is marked private and loses its
files field. engines.node is >=22, the major version script/bootstrap
and the Dockerfile use. The exports map makes "." and "./package.json"
the only importable paths, so the CLI-only modules stay internal.

Model: opus-5-5

package.json

@@ -9,17 +9,23 @@
         "type": "git",
         "url": "https://git.eeqj.de/sneak/quak.git"
     },
+    "private": true,
     "type": "module",
+    "engines": {
+        "node": ">=22"
+    },
     "main": "./dist/src/index.js",
     "types": "./dist/src/index.d.ts",
+    "exports": {
+        ".": {
+            "types": "./dist/src/index.d.ts",
+            "import": "./dist/src/index.js"
+        },
+        "./package.json": "./package.json"
+    },
     "bin": {
         "quak": "./dist/bin/quak.js"
     },
-    "files": [
-        "dist/",
-        "README.md",
-        "LICENSE"
-    ],
     "scripts": {
         "build": "script/build",
         "quak": "node ./dist/bin/quak.js",