Reject a blob_size_limit below the largest possible chunk (closes #167)

Validate only rejected blob_size_limit below chunk_size, but the chunker
can emit chunks up to chunk_size times the FastCDC size spread (four
times), and the packer puts a single chunk of any size into an otherwise
empty blob. A limit between one and four times chunk_size therefore let a
blob reach four times the configured maximum, with most blobs holding a
single chunk and so exposing individual chunk lengths to anyone who can
list the destination.

Validate now rejects blob_size_limit below chunk_size times the spread,
reusing the chunker's one constant (now exported as ChunkSizeSpread)
instead of a second literal. The rule is stated in the error text, the
Validate comment, the README config table, config.example.yml, and the
generated config template.

Model: opus-4-8

internal/cli/config.go

@@ -212,6 +212,8 @@ storage_url: ""
 # chunk_size: 10MB
 
 # Maximum blob size before splitting into a new blob.
+# Must be at least four times chunk_size (the largest chunk the chunker can
+# emit); a smaller limit would let a single-chunk blob exceed it.
 # Accepts: 1GB, 10G, 500MB, etc.
 # Default: 10GB
 # blob_size_limit: 10GB