test(crypto): add bounded fuzz testing for encrypted envelope parsing…

[Anadudev]

Closes #1724

Proposed Changes

Input Boundary & Resource Limits (src/services/crypto/open-envelope.ts)

• Added boundary limits to openEnvelope and helper functions before performing memory-heavy base64/hex decoding or SHA-256 digests:
  • MAX_CIPHERTEXT_BASE64_LENGTH = 10 * 1024 * 1024 (10 MB)
  • MAX_FIELD_STRING_LENGTH = 8192 (8 KB)
  • MAX_ATTACHMENTS_COUNT = 100
  • MAX_RAW_INPUT_STRING_LENGTH = 15 * 1024 * 1024 (15 MB)
• Enforced strict typed error mapping: All unexpected JS exceptions, malformed inputs, base64 decoding errors, and invalid types are wrapped and returned strictly as OpenEnvelopeError with safe public error codes (crypto_validation_error, crypto_parse_error, crypto_version_error, crypto_integrity_error, crypto_decryption_error).
• Added support and safe parsing for raw JSON string inputs representing sealed envelopes.

Fixed CI Fuzz Corpus & Bounded Mutation Tests (tests/unit/crypto/fuzz.test.ts)

• Added fixed hostile CI fuzz corpus testing 26+ hostile inputs (null/primitives, malformed JSON, deep nesting, prototype pollution, oversized string fields, oversized ciphertext, invalid algorithms, bad hex/base64 encodings, excessive attachments).
• Added 100-iteration bounded pseudo-random seeded mutation test runner to ensure mutated envelopes fail safely without uncaught runtime crashes.
• Ensured fuzz suite runs deterministically within a bounded duration (~100ms in Vitest).

Verification Plan

Automated Tests

• npm test passed 24/24 test files and 203/203 unit tests cleanly.
• fuzz.test.ts passed 29/29 tests in 99ms.
• npx eslint passed with 0 errors.

Manual Verification

• Confirmed resource limit constants trigger fast rejection before decoding.
• Confirmed typed OpenEnvelopeError exceptions are returned without exposing sensitive details.

[kryputh]

@Anadudev conflict