fix: populate ctime from platform-specific syscall data

The scanner was setting CTime to info.ModTime() as a placeholder since
afero's FileInfo interface doesn't expose ctime directly. This change
extracts the actual ctime from the underlying syscall.Stat_t via
platform-specific build files:

- macOS (Darwin): uses Birthtimespec (file creation/birth time)
- Linux: uses Ctim (inode change time)
- Other platforms: falls back to mtime

Also adds:
- Documentation of ctime semantics in README.md (new 'file metadata' section)
- Platform differences table (macOS birth time vs Linux inode change time)
- Note that ctime is recorded but not restored (not settable via standard APIs)
- Updated README schema to match actual schema (adds ctime, source_path, link_target)
- Doc comment on CTime field in database model

closes #13

internal/snapshot/ctime_darwin.go

@@ -0,0 +1,23 @@
+package snapshot
+
+import (
+	"os"
+	"syscall"
+	"time"
+)
+
+// getCTime extracts the file creation time (birth time) from os.FileInfo.
+//
+// On macOS (Darwin), this returns the birth time (Birthtimespec) from the
+// underlying syscall.Stat_t. macOS HFS+ and APFS filesystems natively track
+// file creation time, making this a true "created at" timestamp.
+//
+// Falls back to modification time if the underlying Sys() data is not a
+// *syscall.Stat_t (e.g. when using in-memory filesystems for testing).
+func getCTime(info os.FileInfo) time.Time {
+	stat, ok := info.Sys().(*syscall.Stat_t)
+	if !ok {
+		return info.ModTime()
+	}
+	return time.Unix(stat.Birthtimespec.Sec, stat.Birthtimespec.Nsec).UTC()
+}