Reject a metadata database truncated to the age header and nonce (closes #152)

An object holding just the age header and its 16-byte nonce decrypts
without error: the truncated read surfaces as io.ErrUnexpectedEOF at the
age layer, which the zstd decoder maps to a clean EOF at frame start.
blobgen then reported zero bytes and no error, so a truncated stream was
indistinguishable from a valid empty one, and the metadata database
export slipped through — restore built a fresh schema on the empty file
and reported success.

blobgen.Reader.Read now, on EOF, reads once more from the age reader and
surfaces io.ErrUnexpectedEOF unless that read is (0, io.EOF), the state a
genuine end leaves. downloadSnapshotDB additionally rejects a zero-length
decrypted database before any schema is built.

Model: opus-4-8

internal/blobgen/truncation_test.go

@@ -0,0 +1,70 @@
+package blobgen_test
+
+import (
+	"bytes"
+	"io"
+	"testing"
+
+	"filippo.io/age"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/blobgen"
+)
+
+// TestReaderRejectsHeaderNonceTruncation guards against a stream cut right
+// after the age header plus its 16-byte nonce. age.Decrypt still succeeds on
+// such an object, and the zstd decoder maps the age reader's
+// io.ErrUnexpectedEOF to a clean io.EOF at frame start, so without the extra
+// check the truncated stream would read as a valid empty one. Reading it must
+// now fail.
+func TestReaderRejectsHeaderNonceTruncation(t *testing.T) {
+	t.Parallel()
+
+	identity, err := age.GenerateX25519Identity()
+	require.NoError(t, err)
+
+	// Encrypting empty plaintext yields header + nonce(16) + a single
+	// 16-byte final chunk tag. Dropping the trailing tag leaves exactly the
+	// age header plus its nonce — the truncation point that triggers the bug.
+	var full bytes.Buffer
+
+	w, err := age.Encrypt(&full, identity.Recipient())
+	require.NoError(t, err)
+	require.NoError(t, w.Close())
+
+	truncated := full.Bytes()[:full.Len()-16]
+
+	reader, err := blobgen.NewReader(bytes.NewReader(truncated), identity)
+	require.NoError(t, err)
+
+	defer func() { _ = reader.Close() }()
+
+	_, err = io.ReadAll(reader)
+	require.Error(t, err)
+	require.ErrorIs(t, err, io.ErrUnexpectedEOF)
+}
+
+// TestReaderReadsGenuinelyEmptyBlob confirms the truncation check does not
+// reject a legitimately empty payload: a blob written with no data must round
+// trip back to zero bytes with no error.
+func TestReaderReadsGenuinelyEmptyBlob(t *testing.T) {
+	t.Parallel()
+
+	identity, err := age.GenerateX25519Identity()
+	require.NoError(t, err)
+
+	var encrypted bytes.Buffer
+
+	writer, err := blobgen.NewWriter(
+		&encrypted, 3, []string{identity.Recipient().String()})
+	require.NoError(t, err)
+	require.NoError(t, writer.Close())
+
+	reader, err := blobgen.NewReader(bytes.NewReader(encrypted.Bytes()), identity)
+	require.NoError(t, err)
+
+	defer func() { _ = reader.Close() }()
+
+	data, err := io.ReadAll(reader)
+	require.NoError(t, err)
+	require.Empty(t, data)
+}