FetchAndDecryptBlob now returns io.ReadCloser with a hashVerifyReader that computes the double-SHA-256 on-the-fly during reads. Hash is verified on Close() after the stream is fully consumed. This avoids loading entire blobs into memory, which could exceed available RAM. Addresses review feedback on PR #39.