perf(filesearch): make file search opt-in and bound the fd walk

File search shelled out to `fd`/`locate` on every auto-mode keystroke,
walking $HOME and serialising behind a single daemon connection — observed
0.9–1.3s per keystroke, stalling every other provider's results. Gate it
behind explicit intent and bound the walk.

- DynamicProvider::runs_in_auto_mode() (default true); filesearch returns
  false, so it only runs when its `:file` prefix is active — never on a
  bare auto-mode query
- route `/` as a `:file` prefix alias in parse_query (identical ParsedQuery)
- drop the colon-less `file `/`find ` auto-triggers; `:file` / `/` cover it
  (also fixes `:file find me` searching for "me")
- bound fd: --max-depth, --exclude .git/node_modules/target/.cache,
  20 results, 750ms kill-timeout (spawn + drained stdout + reap)
- configurable providers.filesearch_roots (TOML + owlry.set; `~/` expanded,
  non-existent entries dropped); empty searches $HOME

Auto-mode typing drops from up to 1.3s to ~2–20ms; file search stays one
keystroke away.

docs/lua-api.md

@@ -132,6 +132,9 @@ Sets top-level config values. Takes a table of key-value pairs. Calling `owlry.s
 | `frecency` | `boolean` | `true` | Boost frequently/recently used items |
 | `frecency_weight` | `number` | `0.3` | Frecency boost weight (0.0 = off, 1.0 = strong) |
 | `search_engine` | `string` | `"duckduckgo"` | Engine for `:web` / `?` queries (see §6) |
+| `filesearch_roots` | `string[]` | `{}` | Root dirs for `:file` / `/` search (`~/` allowed). Empty searches `$HOME`. Non-existent entries are dropped |
+
+> File search is **opt-in**: it only runs under the `:file` prefix (or the `/` alias), never on a bare query, because each keystroke shells out to `fd`/`locate`. Walks are bounded (depth, excludes, 20 results, 750 ms).
 
 **Example:**