Keep a non-root user's database in the XDG state directory (closes #171)

Without SFDUPES_DATABASE, a user other than root now uses
sfdupes/db.sqlite under $XDG_STATE_HOME (~/.local/state by default),
which scan creates, instead of failing on /var/lib/sfdupes. Root keeps
/var/lib/sfdupes/db.sqlite. sfdupes --help and README say where the
database is. Adds github.com/adrg/xdg, the decided XDG library.

Model: opus-5-5

TODO.md

@@ -29,6 +29,11 @@
 Newest first. An entry ends with its date and its issue or branch, where those
 are known.
 
+- Without `SFDUPES_DATABASE`, a user other than root keeps the database in
+  `sfdupes/db.sqlite` under the XDG state directory, `~/.local/state` by
+  default. Root keeps `/var/lib/sfdupes/db.sqlite`. `sfdupes --help` says where
+  the database is (2026-11-11, https://git.eeqj.de/sneak/sfdupes/issues/171)
+
 - `report` and `trees` leave out empty files. `report` writes no group of size
   0, and `trees` writes no group whose trees hold 0 bytes. An empty file still
   counts toward a tree's digest (2026-11-11,