catalog: lazy remote-refresh of the catalog index (keep bundled fallback) #27

Surfaced by the design/security review on #25.

The catalog is bundled in the wheel, so a newly-merged community profile isn't visible to users until the next release — a PR-to-visible lag that undercuts the "shelf" metaphor. Brew solves this by fetching the index separately from upgrading the tool.

Proposal

• Generate/commit profiles/index.json in CI.
• catalog search/list lazily GET the index from raw.githubusercontent (main) with a short TTL cache at ~/.cache/openapi-cli4ai/catalog.json.
• Fall back to the bundled catalog on timeout/offline — the offline guarantee stays intact.

Acceptance

• Remote index fetch with TTL cache
• Transparent offline/bundled fallback
• No behavior change when offline

Effort: M