control, web: bookmark a repository !288

Bookmarks as the issue frames them: saving someone else's repository to come back to, separate from pins, and a count that measures what people found worth returning to.

Kept separate from pins rather than made a flag on repo_pins, because they answer different questions and have different visibility: a pin is private quick access to your own work and drives the rail, a bookmark is public and counted. New table repo_bookmarks (migration 0043) with an index on repo_id, since the count is read on every repository home.

Capability first, then surfaces: repo bookmark, repo unbookmark, repo bookmarks. The web dispatches those — a toggle on the repository header beside Pin and Watch, the count in the facts bar, and /bookmarks in the rail.

Decisions worth naming:

• Read access is enough. Bookmarking is something you do to someone else's repository; requiring more would defeat the feature. A private repository you cannot read is not found, as everywhere.
• The count is public and names nobody. It is the popularity signal the issue asks for; who bookmarked what is not exposed by any surface.
• A repository bookmarked while public and since made private stays in the table and drops out of the listing, the same way it disappears everywhere else. Covered by TestBookmarkOfRepoGonePrivate.
• The facts bar renders only on a repository with commits, so the count follows that rule rather than making an empty repository show one number.

/bookmarks is a new top-level route, so bookmarks is now a reserved name — caught by the test that enforces it, as was the CLI reachability test when the three commands existed server-side but could not be typed.

TestBookmarks covers bookmarking another user's repository, the count, idempotence, the private-repo refusal, that a bookmark is not a pin, the public count on the page, the web toggle, and the listing.

Stacked on !287.

Closes #146