feat(api): library write endpoints — POST /libraries/clients, PATCH /libraries/:id

[thewrz]

Why

The web UI demo's Library panel can create and rename client libraries, but those endpoints don't exist on main (the conform #231 gates them behind libraryWrites). These re-enable that panel.

What

• POST /libraries/clients → create a client-tier library. Body { name, parentLibraryId? }; parent defaults to the Default Company Master (resolved by name, not hardcoded id), must be company-tier if explicit. 201 with Library; 409 on duplicate name.
• PATCH /libraries/:id → rename. Body { name }; renames name only (owner immutable, §8). Only client-tier libraries are renameable (renaming a built-in master would break name-based resolution). 200; 404 unknown; 409 duplicate; 422 non-client target.

Acceptance

• openapi documents both (contract gate green, response-covered)
• Integration tests cover create/rename + 400/404/409/422 paths
• lint clean

Track A of the demo-backend program (after #227/#229/#231).