Two production blockers from the code review, plus removal of the FFI backend.

Fix #1 — handle leak: nothing tied a registry entry's lifetime to the owning
PHP object, so every open() without an explicit close() leaked an IndexState
(mmap reader + segment FDs, and up to the writer heap) for the life of a
PHP-FPM worker. Add `impl Drop for Index` (RAII release on GC) and an
ExtClient::__destruct() as a deterministic, idempotent release point.

Fix #2 — mutex poisoning: a panic inside a tantivy op under the global table
lock poisoned the Mutex, and every later `.lock().unwrap()` then panicked,
bricking all indexes in the worker. Route all lock sites through a lock_table()
helper that recovers via PoisonError::into_inner() (the guarded HashMap can't be
left half-updated by a panic in the user closure, so recovery is safe).

Both fixes covered by new regression tests (registry poison recovery; ext Drop
releases the handle), written test-first.

Drop the FFI backend entirely (tantivy-ffi crate, C header, FfiClient) so only
the ext-php-rs extension remains. The Client facade now delegates straight to
ExtClient and errors with an actionable message when the extension isn't loaded
(this also closes the FFI-only packaging finding). Updated CI, docs, composer.
Also require IndexBusyException in the PHPUnit bootstrap (latent fatal).

Verified: cargo build --release, cargo test (11 passed), clippy -D warnings,
and the PHP smoke test against the built extension all green.