feat(streaming): add high-level streaming encrypt/decrypt API

[Adel-Ayoub]

Summary

• Add streaming file encryption/decryption with 64KB AEAD chunks and FRB StreamSink progress reporting
• Atomic temp-file-then-rename with TempFileGuard drop guard — failed decrypt never leaves plaintext on disk
• 9-byte AAD (chunk_index + is_final) prevents reorder, duplication, deletion, truncation, and append attacks
• Uniform encrypted chunk sizes on disk (last chunk padded) — no file-size leakage
• Header algorithm cross-checked against cipher at decrypt time
• pub(crate) methods on CipherHandle for internal streaming use
• Generated Dart bindings untracked from git (honor .gitignore)
• 16 new streaming API tests, 117 total tests pass, clippy clean

Files Changed

• rust/src/api/streaming.rs — new encrypt/decrypt impl + FRB wrappers + 16 tests
• rust/src/api/encryption/mod.rs — add encrypt_raw, decrypt_raw, algorithm_id pub(crate)
• rust/src/api/mod.rs — add pub mod streaming
• rust/Cargo.toml — add tempfile = "3" dev-dependency
• rust/src/frb_generated.rs — codegen updated (StreamSink support)
• lib/src/rust/** — untracked generated Dart bindings

Security

Attack	Prevention
Chunk reorder	Index in AAD → auth fails
Chunk deletion	Subsequent indices wrong → auth fails
Truncation	Missing is_final=0x01 → detected
Append after final	Decryptor stops at sentinel
Tampered padding	Zero-byte validation → DecryptionFailed
Partial output on failure	TempFileGuard deletes temp file on drop

Test plan

• cargo test streaming — 16 tests pass (roundtrip, tamper, reorder, truncation, progress, cleanup)
• cargo clippy -- -D warnings — clean (with and without testing feature)
• flutter_rust_bridge_codegen generate — succeeds
• total tests pass