Add libSQL/Turso database backend (1.6.0)

[glani]

Summary

• Adds a libSQL/Turso backend alongside SQLite and PostgreSQL, using the pure-Go libsql-client-go driver — no CGO required.
• libSQL is SQLite-compatible at the schema/SQL level, so the existing migrations/sqlite/*.sql files run unchanged and the SQLiteRepo implementation is reused. Only connection setup differs.
• New config: driver libsql with database.libsql.{url, auth_token} and WORDSTORE_DATABASE_LIBSQL_{URL, AUTH_TOKEN} env overrides.
• Integration tests under internal/repository/libsql_test.go skip cleanly unless WATCHWORD_TEST_TURSO_URL is set, so builds without the secret still pass. Each test uses a random wwtest_<hex>_* word prefix and cleans up its own rows on teardown.
• CI: secrets wired into the main test job; dedicated turso job with continue-on-error: true for visibility.
• README has a top-of-page Turso callout plus a deeper config section.

Behavioral notes (vs. local SQLite backend)

• No client-side pragmas. journal_mode, busy_timeout, synchronous, foreign_keys are server-controlled on Turso; the URI-pragma format used by the local backend is not applied.
• Deferred transactions. No _txlock=immediate equivalent on libsql; the (word, status) UNIQUE constraint remains the source of truth for collision resolution.

Test plan

• All 5 TestLibSQL_* integration tests pass against a local turso dev server (in-memory and file-backed).
• All 5 pass against the hosted watchword-ci Turso DB (aws-eu-west-1).
• End-to-end MCP roundtrip via stdio: store_entry then get_entry_by_word then list_entries against libsql.
• Migrations 001-004 apply cleanly; entry_type, created_by columns plus partial index and unique constraint all created.
• go vet ./... clean, go test -race ./... green, CGO_ENABLED=0 go build works.
• Tests skip cleanly when env unset (verified before secret was added).
• CI green on this PR (will verify after push).