Replace the Rust LSP stub with a pure OCaml server

[gandarfh]

Motivation

The LSP binary was bootstrapped as a Rust wrapper that would link the OCaml library via FFI and depend on httui-core for storage. Measurements showed the FFI premise does not hold: a persistent stdio subprocess round-trips in well under 0.1 ms, and the server only ever needs read-only SQLite access (never the OS keychain — secret values stay on the execution path). Going pure OCaml removes the FFI toolchain entirely (vendoring, macOS rustflags, runtime lifecycle, cross-runtime panics) and keeps this repository single-language.

Changes

• bin/httui-lsp is now an OCaml executable using the lsp/jsonrpc packages: stdio framing, initialize with server info and full-sync capabilities, didOpen/didChange/didClose document store, correct MethodNotFound for unimplemented requests, spec-conformant shutdown/exit.
• CI: Rust job removed; OCaml job aligned to 5.4 and gains a format check; ocamlformat config pinned at 0.28.1.
• bench/lsp_roundtrip.py + make bench: dependency-free transport benchmark against the built binary (spawn-to-initialize, request dispatch round-trip, didChange ingestion).
• Makefile, README and CONTRIBUTING updated for the single-toolchain layout; generated httui_lang.opam committed so opam install . --deps-only works in CI.
• spec/token-kinds.md: fallback is now described as a server-side capability downgrade (clients silently ignore unknown token types, so the server must emit the fallback kind for clients without support); added the rule that the secret modifier implies value masking on every surface.

Validation

dune build, dune runtest, dune build @fmt green. Lifecycle smoke-tested over real JSON-RPC (initialize → didOpen → unknown request → shutdown → exit 0). Bench: dispatch round-trip p95 0.024 ms, didChange+probe p95 0.036 ms on Apple M4.