Keep a non-root user's database in the XDG state directory (closes #171)

Without SFDUPES_DATABASE, a user other than root now uses
sfdupes/db.sqlite in the XDG state directory (~/.local/state by
default) instead of failing on /var/lib/sfdupes. scan creates the
missing directories there with mode 0700, as the XDG Base Directory
specification asks. An XDG_STATE_HOME that is not an absolute path is
a fatal error for every subcommand. Root keeps
/var/lib/sfdupes/db.sqlite. sfdupes --help and README say where the
database is. Adds github.com/adrg/xdg, the decided XDG library.

Model: opus-5-5

TODO.md

@@ -29,6 +29,11 @@
 Newest first. An entry ends with its date and its issue or branch, where those
 are known.
 
+- Without `SFDUPES_DATABASE`, a user other than root keeps the database in
+  `sfdupes/db.sqlite` under the XDG state directory, `~/.local/state` by
+  default. Root keeps `/var/lib/sfdupes/db.sqlite`. `sfdupes --help` says where
+  the database is (2026-11-11, https://git.eeqj.de/sneak/sfdupes/issues/171)
+
 - New `scan` flag `--exclude PATH`, which may be repeated. The walk neither
   enters nor records an excluded path, and keeps the records below it. An
   operand at or below one is a fatal error (2026-11-11,