Add pack, cfl and safehtml

pack loads local product packs (format 1): t5de-product.json and the product's files, as product.chkn or
files/, with index.xml's rating, type, gender and parent product. cfl writes and reads IMVU's product
container, uncompressed. safehtml cleans product descriptions by an allowlist (bluemonday).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

CLAUDE.md

@@ -0,0 +1,21 @@
+# t5de-api
+
+Go definitions shared by T5DE's proxy, hub and catalogs (see README.md, docs/pack.md). Part of T5DE; the proxy is
+`t5de-proxy` (git.t5de.dev/t5de/t5de-proxy) and the design is in `t5de-hub`'s `docs/design.md`, both usually
+checked out beside this one.
+
+## Rules
+
+- Never commit IMVU's code or files: no decompiled source, no product files from IMVU (not even as test data).
+  Test fixtures are synthetic, built in the tests. Our own declarations of IMVU's formats are fine.
+- Test with a throwaway IMVU account, never a real one.
+- Commits: author "dhkatz <dev@t5de.dev>"; never the user's real name or email.
+- Dependencies: the standard library, and bluemonday for `safehtml` (with its own dependencies). Ask before adding
+  others.
+- Descriptions are shown in the client's Gecko pages, which have chrome privileges: `safehtml` is an allowlist,
+  never a blocklist. Every bypass found gets a test.
+
+## Notes
+
+- `gofmt`, `go vet ./...` and `go test ./...` must pass (CI checks them). `go test ./cfl -fuzz FuzzRead` fuzzes
+  the CFL reader.