feat: persistent SQLite storage for bookmarks + positions keyed by content_hash

- new bookish/services/database.py: SQLite with WAL mode, tables for
  bookmarks and reading_positions, keyed by content_hash (SHA256)
- new bookish/routes/api.py: REST endpoints for CRUD bookmarks
  and save/load reading position
- upload endpoint returns content_hash (SHA256 of file)
- reader route computes SHA256 and passes BOOKISH_HASH to template
- reader.js: bookmarks + positions use API server as primary storage
  with localStorage fallback for offline/resilience
- position saves debounced (1.5s) to avoid hammering server
- .gitignore: added bookish.db

bookish/templates/reader.html

@@ -132,6 +132,7 @@
 <script>
     const BOOKISH_FILE = {{ filename | tojson | safe if filename else 'null' }};
     const BOOKISH_EXT = {{ file_ext | tojson | safe if file_ext else 'null' }};
+    const BOOKISH_HASH = {{ content_hash | tojson | safe if content_hash else 'null' }};
 </script>
 <script src="{{ url_for('static', filename='js/reader.js') }}"></script>
 {% endblock %}