Bound download expansion and escape control chars on the terminal (closes #164)

Objects fetched from the store are untrusted; several decode paths let one expand or print without limit.

- blobgen.LimitReader errors past a byte cap (not io.LimitReader silent EOF). DecodeManifest reads through caps on both compressed input and decompressed output, far above any real manifest, so json.Decode cannot buffer a compressible bomb. FetchAndDecryptBlob bounds decompression to the blob recorded uncompressed_size (not the restoring host blob_size_limit).
- downloadSnapshotDB streams straight from storage to its temp file with io.Copy, replacing two ReadAll calls that held the whole database twice.
- FetchBlob drops the per-blob Stat round-trip, its expectedSize parameter and returned size, all of which only fed a debug log.
- TTYHandler and ui.Writer escape control characters in messages, attribute keys/values, and rendered identifiers/paths before colour codes are applied, so a crafted value cannot drive the terminal.

Model: opus-4-8

internal/vaultik/blob_fetch_hash_test.go

@@ -73,7 +73,7 @@ func TestFetchBlobRejectsMalformedHash(t *testing.T) {
 		strings.Repeat("A", 64), // uppercase hex is not accepted
 		strings.Repeat("g", 64), // not hex
 	} {
-		_, _, err := tv.FetchBlob(ctx, bad, 0)
+		_, err := tv.FetchBlob(ctx, bad)
 		if err == nil {
 			t.Fatalf("expected error for malformed hash %q, got nil", bad)
 		}
@@ -113,7 +113,7 @@ func TestFetchAndDecryptBlobVerifiesHash(t *testing.T) {
 		t.Parallel()
 
 		rc, err := tv.FetchAndDecryptBlob(
-			ctx, correctHash, int64(len(encryptedData)), identity)
+			ctx, correctHash, int64(len(plaintext)), identity)
 		if err != nil {
 			t.Fatalf("expected success, got error: %v", err)
 		}
@@ -145,7 +145,7 @@ func TestFetchAndDecryptBlobVerifiesHash(t *testing.T) {
 		mockStorage.mu.Unlock()
 
 		rc, err := tv.FetchAndDecryptBlob(
-			ctx, fakeHash, int64(len(encryptedData)), identity)
+			ctx, fakeHash, int64(len(plaintext)), identity)
 		if err != nil {
 			t.Fatalf("unexpected error opening stream: %v", err)
 		}
@@ -188,7 +188,7 @@ func TestFetchAndDecryptBlobCloseBeforeEOFFails(t *testing.T) {
 	tv := vaultik.NewForTesting(mockStorage)
 
 	rc, err := tv.FetchAndDecryptBlob(
-		context.Background(), correctHash, int64(len(encryptedData)), identity)
+		context.Background(), correctHash, int64(len(plaintext)), identity)
 	if err != nil {
 		t.Fatalf("unexpected error opening stream: %v", err)
 	}