Add a book reservation/hold queue

## What problem does this solve?

`POST /api/v1/loans` returns `409` when a book has no available copies (per `totalCopies` vs. active loans), but that's a dead end for the borrower — there's no way to express "let me know when a copy frees up." Right now they just have to keep polling `GET /api/v1/books/{id}`.

## Proposed solution

- Add a `holds` table (`book_id`, `borrower_id`, `requested_at`, `status`) and `POST /api/v1/books/{id}/holds` / `DELETE /api/v1/holds/{id}` endpoints, JWT-gated.
- On `POST /api/v1/loans/{id}/return`, check for an outstanding hold on that book (oldest first) inside the same transaction that currently updates copy availability, and either auto-create the loan for the head-of-queue borrower or mark the hold `ready_for_pickup` depending on the desired policy.
- Add `holds list`/`holds place`/`holds cancel` CLI subcommands mirroring the existing `loans borrow`/`loans return` pattern in `internal/cli`.

## Alternatives considered

Leaving this to an external process that polls availability — works but means reinventing queue-fairness (FIFO) logic outside the transactional guarantees the borrow/return flow already has.

## Area

Loans (borrow / return)

## Priority

Would significantly improve the catalog's usefulness for popular titles with limited copies — the single biggest missing piece of a "real" library workflow.