feat(backends): add claude-cli backend to standalone CLI

[devswha]

Follow-up to #69 (v2 phase). v1 (codex-cli) shipped via PR #70.

Goal

Add a claude-cli backend that spawns claude -p with the patina prompt on stdin, returning the cleaned text. Unlocks key-free use for users with a Claude Code subscription.

Sketch

• src/backends/claude-cli.js mirroring codex-cli.js shape
• isAvailable() checks claude --version
• isAuthenticated() checks ~/.claude/credentials or equivalent (verify path)
• invoke() spawns claude -p, pipes prompt to stdin, captures stdout
• Register in src/backends/index.js REGISTRY
• Heuristic: --model claude* → claude-cli (mirroring codex)
• Per security: require explicit opt-in or sandboxing for codex-cli backend #88 hardening: NO silent auto-fallback. Require explicit --backend claude-cli (or --model claude*)
• Sandbox: pass equivalent of --sandbox read-only if claude CLI supports it; otherwise document the trust assumption

Acceptance

• patina --backend claude-cli input.txt works when claude is installed and logged in
• patina --model claude-sonnet-4-6 input.txt routes to claude-cli
• patina auth status reports availability + auth state
• No silent auto-fallback (per security: require explicit opt-in or sandboxing for codex-cli backend #88 policy)
• Tests: backend mock + selection routing
• Docs: README CLI section mentions claude-cli alongside codex-cli

Out of scope

• Mixed-backend MAX mode (tracked under v3 of feat: add codex (and other CLI) backend support to standalone patina CLI #69; will be a separate issue once v2 lands)