docs: document the exported API, and fix five bugs found writing it

[ccleberg]

Closes #1.

Documentation

The package carried 35 Russian comments and no doc comments on its exported
identifiers, so pkg.go.dev rendered a bare list of signatures. Every exported
identifier now has a godoc-form comment, and doc.go adds a package overview
covering the guest-session requirement, the Error-as-struct convention, and
CloudFront blocking.

The comments record what the signatures cannot: that UpdateCSRF must run first
and that its token expires, that Error is a struct and so is never nil, that
Thread is one comment rather than a thread, and that GetComments' page
parameter costs one request per page.

On the issue's third item — a dedicated docs site looks unnecessary. pkg.go.dev
already indexes this module (v0.3.1) and will pick these comments up on the next
tag, with no build step or hosting to maintain. The README is the gap worth
filling instead, since it lists endpoints but shows no usage; the package doc now
has an example that could be mirrored there.

Fixes

Documenting the API meant writing down behavior that was too alarming to leave
alone. A library should never kill the process that imports it:

• GetComments panicked on a comment with an empty body (m[0] unguarded).
• Group.Favourites and Group.Gallery panicked when folderid was omitted,
  which their variadic signatures invite. Omitting it now means 0.
• AEmedia and PerformSearch called log.Fatalln on a bad argument,
  terminating the caller. Both now return an error, which their signatures
  already allowed for.

Two more in the Draft.js flattening, which GetComments and GetDeviation now
share rather than each keeping a copy of:

• The block loop assigned rather than accumulated, so a multi-paragraph body came
  back as its closing line alone.
• GetDeviation guarded on txt[1] == '{' — the second character of a body that
  opens with {"blocks". It never fired, so descriptions were returned as raw
  Draft.js JSON rather than text.

The docs and the fixes are one PR because the doc comments describe the fixed
behavior; splitting them would mean writing those comments twice.

Behavior changes, worth a careful look

Both flattening fixes change output for existing callers. Comment and
Description will return text that is longer (every paragraph, not just the
last) and, for descriptions, no longer raw JSON. This is what the code always
intended, but it is a real change and not merely a crash fix.

The GetDeviation fix is verified by reasoning about the guard rather than
against the live API, since GetDeviation has no seam to inject a response
through — worth a second opinion from someone who knows what DeviantArt actually
returns. flattenComment itself is covered directly by tests.

Checks

go build, go vet, go test (16 tests), and golangci-lint run all pass; no
Cyrillic remains in the tree.

Not addressed

Left alone deliberately, as out of scope and breaking: Thread.Desctiption is
misspelled and Post.ParsedComments appears to be dead — nothing populates
either, but renaming an exported field breaks the API and I could not confirm
from the code alone whether DeviantArt ever sends them.