feat: bounded CLI input reading and CI hardening

[T3pp31]

Summary

• Add bounded_input module for chunked stdin reads (8 KB buffer) and streaming file reads with a 10 MB cap.
• Reject non-regular file paths (directories, devices, FIFOs) and enforce limits while reading (TOCTOU-safe).
• Apply bounded reading to CLI stdin, interactive mode, and shift prompts (MAX_SHIFT_LINE_SIZE).
• Align decrypt_safe with decrypt to avoid duplicated logic.
• Document Basic vs Safe APIs and per-input-path size limits in README and rustdoc.
• Move config invariant checks to compile-time const _ block (fixes clippy::assertions_on_constants on tests).

CI follow-up (local commit not yet pushed)

A second commit (ci: run all-target clippy and rustsec audit-check) updates .github/workflows/ci.yml but could not be pushed automatically because the GitHub token lacks the workflow scope. After merging or before merge, run:

gh auth refresh -h github.com -s workflow
git push origin feat/bounded-input-and-ci-hardening

That push adds:

• cargo clippy --all-targets --all-features -- -D warnings
• rustsec/audit-check@v2.0.0 instead of per-job cargo install cargo-audit

Test plan

• cargo test (150 tests)
• cargo clippy --all-targets --all-features -- -D warnings
• GitHub Actions on this PR (after CI commit is pushed)

Made with Cursor