The client_id used during token refresh didn't match the one from login,
causing the PDS to reject refresh requests. Sessions now last up to 2
weeks instead of expiring after ~2 hours.

README previously said metadata came from kipclip.com endpoint —
enrichment is now done client-side.

- GitHub Actions CI with fmt, clippy, test, build
- Search/filter bookmarks by title, URL, description
- Ref-based bookmark resolution (rkey prefix matching)
- Client-side URL enrichment with HTML parsing and sanitization
- JSON output mode for list and tags commands
- Terminal-aware display with unicode width handling
- Notes support on bookmarks via annotation sidecar

Fetch and parse HTML metadata directly in the CLI instead of calling
the kipclip.com appview. Extracts title, description, favicon, and
og:image using regex-lite. Makes the CLI fully independent — zero
reliance on kipclip.com beyond the user's own PDS.