Phase 18: md serve thin local read-only folder browser

[lidonggui]

Summary

• Add md serve <dir> bin (@roobli/md) — thin localhost HTTP read-only folder browser (not Electron Noto, not holt, not presence).
• Markdown preview: parseBlocks → ported spansToHtml (Noto.docs dogfood pattern); no marked/micromark as primary HTML path.
• IA from atelier skeleton: left tree (~248px), thin top bar (crumbs + type badge + 只读), main preview (md / text / image / empty / unsupported+download).
• Defaults: bind 127.0.0.1:4321; --host 0.0.0.0 must be explicit. Root pinned by CLI; cold-start opens README.md when present.
• Version left at 0.1.14 for release chore (no publish from this PR).

Test plan

• pnpm verify (typecheck + 109 tests + build)
• Smoke: node dist/serve/cli.js serve <fixture> — tree, md HTML, text, image, unsupported, path traversal blocked
• Manual: open browser at printed URL; click tree; confirm paper-like MD measure ~42rem

How to run locally

pnpm build
node dist/serve/cli.js serve ./some-folder
# or: pnpm link / npx → md serve ./some-folder