feat(esm_catalog): PR-C2 — personal collections (storage + API routes)

[siligam]

Summary

Provenance: this implementation is substantially Paul Gierz's work, carried over from his esm-tools-plus/simcat/pgierz-workbench prototype branch (commits Mar–Apr 2026). This PR ports it, largely as-is, into the reviewable stack.

• Adds storage/personal.py: PersonalCollectionStore — DuckDB-backed per-user collections with RBAC (owner/maintainer/developer/viewer roles), item refs, labels, shared access, and sidebar tree
• Adds api/personal_models.py: Pydantic request/response models for all personal-collections endpoints
• Adds api/personal_routes.py: create_personal_router() — full CRUD under /users/{username}/... for collections, items, labels, shares, and tree; open-access (no auth required when authenticator=None)
• Wires router into create_app() inside a try/except so the API degrades gracefully if personal.duckdb is inaccessible
• Adds pytz to [catalog] extras and CI pip install line — required by DuckDB TIMESTAMPTZ column deserialization
• 25 new tests covering storage layer (direct) + all route groups (via TestClient)

Test plan

• pytest src/esm_catalog/tests/test_personal_collections.py -v — 25 pass
• pytest src/esm_catalog/tests/ — 162 total green
• CI esm-catalog-tests passes on Python 3.9 + 3.12

Stack position

release → PR-0 → A1a → A1b-1 → A1b-2 → A2 → A3 → A4 → B1 → B2 → B3 → B4 → C1 → C2 (this PR)

🤖 Generated with Claude Code

[siligam]

Rebased onto the corrected PR-0 base (#1483) — test relocation to tests/test_esm_catalog/, restored dedicated CI workflow at the new path, and a couple of CI fixes (doctest-collection exclusion, eval_type_backport for pydantic on Python 3.9). No change to this PR's own diff/scope. CI is green.