feat: support appstream data keywords and categories for FTS

[m1rm]

TL;DR

Integrates Arch Linux AppStream metadata into the Go app: keywords and categories columns on package, filled from upstream Components-x86_64.xml.gz on sources.archlinux.org, exposed to FTS5 search with tuned BM25 weights. Adds a update-appstream CLI command and just update-appstream / inclusion in just update-data.

Motivation

Improve package search (including German-oriented terms) using AppStream and data.
Keep the implementation streaming and aligned with existing update jobs (pacmandb-style callback parsing).

Data source & versioning

• Snapshot directory (e.g. 20260326): https://archlinux.org/packages/extra/any/archlinux-appstream-data/json/ (pkgver).
• Per-repo XML: {APPSTREAM_SOURCES_BASE}{pkgver}/{core|extra|multilib}/Components-x86_64.xml.gz
• default base: https://sources.archlinux.org/other/packages/archlinux-appstream-data/

Behaviour

What is indexed

• Keywords: text from only (not name/summary/description).
• Categories: text from only (not pacman groups).
• Language:
  • blocks without xml:lang (neutral),
  • en / de (including BCP47 prefixes like de-DE),
  • and the same rules on individual / when present.
• Stopwords: English + German closed-class words stripped in dedupeWords before storage (dedupe is case-insensitive)

Database & search

• Migrations add keywords and categories on package, extend package_fts with matching columns, rebuild after changes.
• update-packages upserts do not overwrite keywords / categories (same pattern as popularity).
• Search uses BM25 with higher weight on name/description than on keywords / categories to limit dilution from AppStream text.

Operations

• go run . update-appstream (requires DATABASE; optional APPSTREAM_SOURCES_BASE).
• just update-appstream; just update-data runs update-appstream after update-packages.

Testing

• Unit tests for XML parsing (keywords, categories, xml:lang on blocks and elements), keywordLangAccepted, stopwords, dedupeWords.
• Tests updated for new FTS column list; just test / just lint pass.

Follow-ups (optional)

• If we chose to keep both keywords and categories, we could merge the migrations into one single migration
• Surface categories in the package detail UI if desired.
• Revisit BM25 weights after production metrics.