feat: add noirdoc ns summary <ns> for counts-only namespace inspection

[comppaz]

Closes #1.

Summary

• New CLI subcommand noirdoc ns summary <ns> returns only counts — total_entities and per-label by_type — never the original values.
• Safe to call from wrappers (e.g. noirdoc-claude-plugin's /noirdoc-status), CI/audit scripts, and any pipeline that captures stdout into longer-lived buffers.
• Companion to ns show, which remains the human-facing full-mapping dump.

Output shape matches the issue spec:

{
  "namespace": "mandant-foo",
  "total_entities": 42,
  "by_type": { "PERSON": 12, "EMAIL": 7, "IBAN": 3, "LOCATION": 15, "DATE": 5 }
}

Implementation notes

• Reuses PseudonymMapper._counters (already maintained per unique entity inside get_or_create) via a new public get_counts_summary() method — no regex parsing of placeholder keys, no reaching into private attributes from the CLI.
• total_entities is sourced from entity_count (canonical mapping size), by_type from the counter map. In custom-label mode (PseudonymMapper(label="X")), by_type reflects the label, matching what the placeholder format actually encodes.
• Not-found contract is identical to ns show: stderr "Namespace '<name>' does not exist." and exit code 1.
• No changes to storage format, namespace encryption, or detector code.

Test plan

• tests/test_mapper.py::test_counts_summary — unit test for the new mapper method, including an assertion that originals never appear in json.dumps(summary)
• tests/test_cli.py (new file) — CliRunner covering the happy path (asserts originals don't leak into stdout) and the not-found path (asserts the exact error message + exit 1)
• Full mapper/namespace/CLI suite (23 tests) green
• ruff check, ruff format --check, mypy clean on touched files
• Manual smoke: noirdoc ns summary __does_not_exist__ → stderr message + exit 1; --help lists the new command

Pre-existing failures in test_flair_recognizer.py (missing [full] extra) and two Presidio detector tests are unrelated to this change.

Follow-up (not in this PR)

After release, noirdoc-claude-plugin's /noirdoc-status should be updated to call ns summary instead of ns list, and its PreToolUse hook should allow ns summary (still blocking ns show and lookup).