feat: add full community bookmark tag management

[CountableNewt]

What changed

• adds canonical tag normalization with the community limits of 100 tags, 64 graphemes, and 640 UTF-8 bytes
• adds exact case-sensitive bookmark filtering while preserving the underlying page cursor on empty filtered pages
• adds paginated tagCounts, replacement/clear APIs, and XRPC client contracts aligned to latr-packages PR #7
• adds CID-guarded rename/delete batches capped at 25 scanned records
• adds resumable mutation and verification cursors so completion requires a full no-match pass
• preserves unknown bookmark fields across every update

Why

LTR-15 needs a shared Swift contract before the gateway, L@tr.link, and The Social Wire can implement compatible tag organization. The bounded cursor model keeps global changes retryable and avoids unbounded PDS writes.

Public API

• bookmarks(limit:startingAfter:taggedWith:)
• bookmarkTags(limit:startingAfter:)
• setTags(ofBookmarkURI:to:)
• renameTag(_:to:limit:continuingFrom:)
• deleteTag(_:limit:continuingFrom:)
• XRPC descriptors and input/output models for listTags, setTags, renameTag, and deleteTag

Concurrency and retry behavior

Each global batch uses one atomic applyWrites call with every source CID. A conflict commits none of that batch and the caller retries the same cursor. After mutation reaches the end, verification scans from the beginning; any reintroduced source tag is changed and verification restarts. A nil cursor is the only completion signal, matching the public Lexicon result shape.

Testing

• 46 XCTest tests passed
• 8 Swift Testing tests passed
• warnings treated as errors
• exact/case-sensitive filtering and empty-page cursors
• tag counts across 55 records
• Unicode, whitespace, grapheme, byte, and count limits
• replacement, clear, target collision, and unknown-field preservation
• 25-record batch boundaries, conflict retry, cursor validation, and verification restart
• XRPC descriptor, query, body normalization, and response decoding coverage

Dependency

PR #2 landed as e6c1fe8; this branch is rebased directly onto that main merge. The wire contract depends on latr-packages PR #7, including its corrected setTags proof budget of three getRecord proofs plus one applyWrites proof.

Risk

No deployment or Production change. The gateway and apps must pin this commit only after latr-packages PR #7 matches these wire shapes and the canonical Lexicons pass their publication gate.

[linear-code]

LTR-15