feat: add GET /catalog for a product picker

[TITeee]

Problem

With the catalog (#88) and the search by a catalog name (#89) in place, a client has no way to list the catalog. heretix-management needs it to offer a picker for hand-registered products, instead of asking the user to type a CPE product name.

Changes

• GET /api/v1/catalog serves the catalog from memory (no query), so it is cheap enough to call on every keystroke.
  • q is matched against the name, aliases, vendor and product, ignoring case and treating space, -, _, . and / alike (big ip, big_ip and the alias bigip all find F5 BIG-IP). The exact name or alias comes first, then names starting with the text, then vendors and products starting with it, then names containing it.
  • category and limit (default 50, max 200) narrow the list; total counts what matched before the limit.
  • Without q, every entry by category and name.
• Each entry says where a search by its name looks (sources: nvd, cna) and carries the exact vendor and product pairs, so a client can show where a result will come from.
• searchCatalog / catalogListing in src/utils/catalog-search.ts do the matching and the shaping.
• docs/api.md, and the endpoint tables in README.md and README.ja.md.

No schema change; the route sits behind the same API key as the others.

Test plan

• vitest (741 unit tests, 7 new), test:integration (98, four new: the API key is required, an entry lists its sources and pairs, found by vendor / alias / changed separators, category and limit with total), tsc --noEmit, eslint
• After deploy, GET /api/v1/catalog?q=ivanti returns Ivanti Automation