feat(cli): add recoverable audit flow

[jx-grxf]

Summary

• add first-run tutorial, legal-first startup ordering, themed password masking, and clearer book selection
• add recoverable login, Chrome startup, dependency, OCR, and per-book failure flows with --allow-partial
• harden managed export folders, Windows-safe filenames, OCR preflight checks, Linux Chrome guidance, README/public docs, security policy, changelog, and package metadata

Tests

• uv run ruff check .
• uv run pytest
• uv run digi2pdf --version

Notes

• No release created. Windows EXE smoke still needs to run from the release workflow before a release is cut.
• Commit is SSH-signed with a temporary local Codex key because the configured personal SSH signing key was locked in this session.